typespec-http-zod 0.29.0 → 0.31.0

package/dist/src/zod.js

@@ -1,7 +1,11 @@
-import { getDiscriminatedUnion, getDiscriminator, getDoc, getEncode, resolveEncodedName, isNeverType, isTemplateDeclaration, } from "@typespec/compiler";
-import { createMetadataInfo, getCookieParamOptions, getHeaderFieldName, getPathParamName, getQueryParamName, isCookieParam, isHeader, isPathParam, isQueryParam, Visibility, } from "@typespec/http";
-import { applyConstraints } from "./constraints.js";
+import { getDiscriminatedUnion, getDiscriminatedUnionFromInheritance, getDiscriminator, getDoc, getEncode, getTypeName, ignoreDiagnostics, resolveEncodedName, serializeValueAsJson, isNeverType, isTemplateDeclaration, } from "@typespec/compiler";
+import { createMetadataInfo, getCookieParamOptions, getHeaderFieldName, getVisibilitySuffix, getPathParamName, getQueryParamName, isCookieParam, isHeader, isPathParam, isQueryParam, Visibility, } from "@typespec/http";
+import { $ } from "@typespec/compiler/typekit";
+import { z } from "zod";
+import { isReadonlyProperty, shouldInline } from "@typespec/openapi";
+import { applyConstraints, firstReportOf, brokenConstraintOf, brokenItemsOf, hasConstraints, } from "./constraints.js";
 import { literal } from "./literal.js";
+import { isPublishedSplit, isSharedRouteOptional, isSuffixedByUsage, keptVisibilityOf, readVisibilityOf, } from "./published.js";
 import { reportDiagnostic } from "./lib.js";
 /**
  * What a walk returns after reporting a refusal.
@@ -22,14 +26,19 @@ export const UNREPRESENTABLE = "z.never()";
  * in rather than computed here.
  */
 let annotateDeferred = () => undefined;
-export function withDeferredAnnotator(annotator, run) {
+/** The same, for a value no property declares: an envelope's `value`, typed as its variant. */
+let annotateDeferredType = () => undefined;
+export function withDeferredAnnotator(annotator, typeAnnotator, run) {
     const previous = annotateDeferred;
+    const previousType = annotateDeferredType;
     annotateDeferred = annotator;
+    annotateDeferredType = typeAnnotator;
     try {
         return run();
     }
     finally {
         annotateDeferred = previous;
+        annotateDeferredType = previousType;
     }
 }
 /**
@@ -127,52 +136,255 @@ export function withSealedObjects(sealed, run) {
  * from answering differently. Measured on `type/model/visibility`: openapi3 emits five components
  * for one model, and before this we emitted one carrying every lifecycle property at once.
  *
- * **Position is a SECOND axis, and this only handles the first.** `@header` is metadata at a
- * payload root and ordinary data nested inside a `@body`; `isPayloadProperty` takes a third
- * argument, `ignoreMetadataAnnotations`, which openapi3 threads as emitter context
- * (`schema-emitter.js:210`) and this does not pass. A metadata-carrying model used in **both**
- * positions therefore still loses the header property where the document keeps it.
- *
- * That shape is rare rather than theoretical: it raises `metadata-ignored` from `@typespec/http`,
- * which fires **zero** times across all 65 `@typespec/http-specs` scenarios,
- * and one variant of it makes openapi3 itself fail with `duplicate-type-name`. It is a real gap with
- * no known occurrence - recorded here rather than described as an incident, because it has not been
- * one.
+ * **Position is a SECOND axis**: `@header` is metadata at a payload root and ordinary data inside
+ * an explicit `@body` - see {@link withMetadataAnnotationsIgnored}, which carries openapi3's third
+ * argument to `isPayloadProperty`.
  *
  * Scoped rather than threaded through six signatures, matching the idiom the rest of this module
  * already uses - the walk is deeply recursive and a parameter would have to be carried by every
  * function whether it cared or not.
  */
 let visibility = Visibility.Read;
-let metadataInfo;
-export function withVisibility(program, next, run) {
+/**
+ * **One metadata view per program**, because the compiler's state lives on the program. Kept in one
+ * module variable, a view built for one compile was read by the next one in the same process -
+ * whatever first asked outside a walk left it there - and that program's `@visibility` and `@header`
+ * were invisible to it: a create-only or `@header` declaration counted as payload in every compile
+ * after the first.
+ */
+const metadataInfos = new WeakMap();
+/**
+ * **openapi3's own metadata view: `Read` is canonical, and a read-only property is shareable.**
+ *
+ * Built with `@typespec/http`'s defaults, the canonical visibility was `All`, so a model whose
+ * create-only property is visible at `All` was not transformed at `Create`: its create body
+ * collapsed onto the bare declaration, and every response was then validated as the CREATE view -
+ * `{name}` refused for want of the `secret` no response carries. And a read-only `id` made a model
+ * transformed at `Create`, where openapi3 shares the canonical schema, so the create body was
+ * validated without the `id` the document requires. Both are openapi3's arguments in
+ * `openapi.js`, passed as it passes them.
+ */
+export function metadataInfoOf(program) {
+    let info = metadataInfos.get(program);
+    if (info === undefined) {
+        info = createMetadataInfo(program, {
+            canonicalVisibility: Visibility.Read,
+            canShareProperty: (property) => isReadonlyProperty(program, property),
+        });
+        metadataInfos.set(program, info);
+    }
+    return info;
+}
+export function withVisibility(next, run) {
     const previousVisibility = visibility;
-    const previousInfo = metadataInfo;
     visibility = next;
-    metadataInfo ??= createMetadataInfo(program);
     try {
         return run();
     }
     finally {
         visibility = previousVisibility;
-        metadataInfo = previousInfo;
     }
 }
 /** Whether a property is optional AT THE CURRENT POSITION - PATCH makes update fields optional. */
 export function isOptionalAt(program, property) {
-    metadataInfo ??= createMetadataInfo(program);
-    return metadataInfo.isOptional(property, visibility);
+    return (metadataInfoOf(program).isOptional(property, visibility) || isSharedRouteOptional(property));
 }
 /** Whether a property belongs in the BODY at the current position, rather than being metadata. */
 export function isPayloadProperty(program, property) {
-    metadataInfo ??= createMetadataInfo(program);
-    return metadataInfo.isPayloadProperty(property, visibility);
+    return metadataInfoOf(program).isPayloadProperty(property, visibility, metadataIgnored);
+}
+/**
+ * **Whether the walk is inside an explicit `@body` whose type carries metadata annotations.**
+ *
+ * `@header` is metadata at a payload root and ordinary data inside a `@body`: `@typespec/http`
+ * ignores the annotation there, and openapi3 renders such a body - and every type under it - with
+ * `ignoreMetadataAnnotations`, so `@header("x-code") @maxLength(3) code` is published as a body
+ * property with its constraint. Not passed, the property was dropped from the body the document
+ * requires it in; and a model's `@header` read as data everywhere enforced its `@maxLength` on a
+ * response that never carries it. Both are openapi3's one rule: `body.isExplicit &&
+ * body.containsMetadataAnnotations`.
+ */
+let metadataIgnored = false;
+export function withMetadataAnnotationsIgnored(ignored, run) {
+    const previous = metadataIgnored;
+    metadataIgnored = ignored;
+    try {
+        return run();
+    }
+    finally {
+        metadataIgnored = previous;
+    }
+}
+/**
+ * **Whether the walk is inside a multipart part whose union holds raw `bytes`**: openapi3 renders
+ * such a part in the form's own content type, where a `bytes` member of a union is the raw binary
+ * `{}` - any value - rather than a base64 string. `HttpPart<bytes | string>` is `anyOf: [{}, string]`,
+ * and validated with `bytes` as a string it refused every file the document accepts. Keyed on by the
+ * registries, as a named union published there is a schema of its own.
+ */
+let multipartBinary = false;
+export function withMultipartBinary(binary, run) {
+    const previous = multipartBinary;
+    multipartBinary = binary;
+    try {
+        return run();
+    }
+    finally {
+        multipartBinary = previous;
+    }
+}
+export function multipartBinaryContext() {
+    return multipartBinary;
+}
+/** `bytes` kept raw, as openapi3's `isBytesKeptRaw` reads it: the standard scalar, not encoded. */
+export function isRawBytes(program, type) {
+    return type.kind === "Scalar" && type.name === "bytes" && getEncode(program, type) === undefined;
+}
+/** A union one of whose own members is raw `bytes` - see `withMultipartBinary`. */
+export function holdsRawBytes(program, type) {
+    return (type.kind === "Union" &&
+        [...type.variants.values()].some((variant) => isRawBytes(program, variant.type)));
+}
+/** Whether metadata annotations are ignored where the walk is - the registry keys declarations on it. */
+export function metadataAnnotationsIgnored() {
+    return metadataIgnored;
+}
+/** Whether this model or union is shaped differently at `visibility` than at the canonical `Read`. */
+export function isTransformedBy(program, type, at) {
+    return metadataInfoOf(program).isTransformed(type, at);
+}
+/**
+ * **The visibility a type is rendered at where another type refers to it: openapi3's
+ * `reduceContext`.** A type that is not transformed at the requested visibility renders at `Read`, so
+ * a model with nothing create-specific inside a create body IS the canonical schema - a read-only
+ * property shared into it, as `canShareProperty` says. Rendered at the requested visibility under the
+ * canonical name, the body dropped that property while the document requires it.
+ *
+ * **Only where openapi3 reduces.** Its asset emitter asks for a reference context by what it emits:
+ * a named model, a model expression, a template instance, a named union, a scalar or an enum. A list -
+ * `T[]` or `model Tags is Tag[]` - and a union expression or instance have none, so they keep the
+ * visibility they were reached at, and so does everything inside them. Reduced here as well, a
+ * `model Tags is Tag[]` sent in a create body and returned was one declaration where the document
+ * publishes `TagsCreate` and `Tags`, and a model expression inside a union expression in a create
+ * body was judged at `Read`, where openapi3 reads its properties at `Create`.
+ */
+export function renderedVisibilityOf(program, type, requested) {
+    if (requested === Visibility.Read)
+        return Visibility.Read;
+    switch (type.kind) {
+        // A reference to a variant, `U.a`, is its type's - see `publicationOf`.
+        case "UnionVariant":
+            return renderedVisibilityOf(program, type.type, requested);
+        case "Model":
+            if (isArrayLiteral(program, type) || isNamedList(type))
+                return requested;
+            return isTransformedBy(program, type, requested) ? requested : Visibility.Read;
+        case "Union":
+            if (type.name === undefined || type.templateMapper !== undefined)
+                return requested;
+            return isTransformedBy(program, type, requested) ? requested : Visibility.Read;
+        // A tuple is written out where it is used, each element at the visibility around it.
+        case "Tuple":
+            return requested;
+        default:
+            return Visibility.Read;
+    }
+}
+/**
+ * **The visibility an operation's body, parameter or response is rendered at: openapi3's
+ * `emitTypeWithSchemaEmitter`**, which renders a type at `Read` unless it is transformed at the
+ * requested visibility - whatever kind of type it is, a list included.
+ */
+export function rootVisibilityOf(program, type, requested) {
+    if (type.kind === "UnionVariant")
+        return rootVisibilityOf(program, type.type, requested);
+    return requested !== Visibility.Read &&
+        (type.kind === "Model" || type.kind === "Union") &&
+        isTransformedBy(program, type, requested)
+        ? requested
+        : Visibility.Read;
+}
+/**
+ * **Whether openapi3 can name a template instance**: its asset emitter's `declarationName`, which
+ * spells each argument's own name after the template's and gives up where one has none - a model
+ * expression, a literal, an instance of no nameable arguments. Such an instance is written out where
+ * it is used: `Maybe<{ x: string }>` is no component, and declared as `Maybe` it was one name for two
+ * schemas wherever a second argument appeared.
+ */
+export function isSpeakableInstance(type) {
+    if (!("templateMapper" in type) || type.templateMapper === undefined)
+        return true;
+    return type.templateMapper.args.every((argument) => {
+        const each = "entityKind" in argument && argument.entityKind === "Indeterminate"
+            ? argument.type
+            : argument;
+        if (!("kind" in each))
+            return false;
+        switch (each.kind) {
+            case "Model":
+            case "Scalar":
+            case "Interface":
+            case "Operation":
+            case "Enum":
+            case "Union":
+            case "Intrinsic":
+                return typeof each.name === "string" && each.name !== "" && isSpeakableInstance(each);
+            default:
+                return false;
+        }
+    });
+}
+/** A named list model, `model Tags is Tag[]`, which openapi3 emits as an `arrayDeclaration`. */
+export function isNamedList(type) {
+    return (type.name !== "" && type.templateMapper === undefined && type.indexer?.key.name === "integer");
+}
+/**
+ * **An array literal's elements are rendered at `Item` visibility**, as openapi3's
+ * `arrayLiteralReferenceContext` renders them: PATCH leaves a list's items required, and metadata on
+ * an element is data, since no element carries a header. Read at the list's own visibility, a PATCH
+ * made every item's properties optional, a `@header` on an element dropped out of the list the
+ * document requires it in, and one such model in a request list and a response list was two shapes
+ * under one name - `TaggedCreateItem` and `TaggedItem` in the document. A named list model is a
+ * declaration, rendered at its own visibility.
+ */
+export function atItem(program, list, run) {
+    return isArrayLiteral(program, list) ? withVisibility(visibility | Visibility.Item, run) : run();
+}
+/**
+ * **An array literal, `T[]`, rather than a named list model** - as openapi3's asset emitter tells
+ * them apart, by name: a list called `Array` with no properties of its own. A visibility template's
+ * copy of `Pet[]` is no standard type, and read as a named list it was declared as `Array`, one
+ * name for every such copy.
+ */
+export function isArrayLiteral(program, list) {
+    return $(program).array.is(list) && list.name === "Array";
+}
+/**
+ * **Whether the walk is rendering an operation's parameter or response header itself**, outside any
+ * declaration it refers to. A tuple there is refused: openapi3 publishes `prefixItems` over the
+ * values the parameter carries, and nothing here reads a parameter's text as positions. A model a
+ * parameter refers to is a component the document shares with every other use, and a tuple in it is
+ * validated as the document publishes it.
+ */
+let parameterPosition = false;
+export function withParameterPosition(inside, run) {
+    const previous = parameterPosition;
+    parameterPosition = inside;
+    try {
+        return run();
+    }
+    finally {
+        parameterPosition = previous;
+    }
 }
-/** Whether this model is shaped differently at `visibility` than at the canonical `Read`. */
-export function isTransformedBy(program, model, at) {
-    metadataInfo ??= createMetadataInfo(program);
-    return metadataInfo.isTransformed(model, at);
+export function inParameterPosition() {
+    return parameterPosition;
 }
+/** Why a tuple parameter is refused, and what to write instead - both walks say the same. */
+export const TUPLE_PARAMETER = {
+    why: "a parameter typed as a tuple, which openapi3 publishes as `prefixItems` over the values it carries and this emitter does not read from the wire",
+    remedy: "Declare the parameter as a list of one element type, or carry the value in the body.",
+};
 /** The visibility the current walk is emitting for - the registry keys declarations on it. */
 export function currentVisibility() {
     return visibility;
@@ -183,7 +395,7 @@ export function currentVisibility() {
  * A template declaration is not a real subtype, and neither is an uninstantiated template; both
  * would otherwise stop a base from being sealed for no reason a reader could see.
  */
-function includeDerivedModel(model) {
+export function includeDerivedModel(model) {
     return (!isTemplateDeclaration(model) &&
         (model.templateMapper?.args === undefined ||
             model.templateMapper.args.length === 0 ||
@@ -233,7 +445,7 @@ export function noteKeyVocabularies(program, models, wanted) {
         if (!wanted.includes(model.name))
             continue;
         found.push(model.name);
-        noteVocabulary(model.name, inheritedAndOwnProperties(model).map((property) => rawPropertyKey(program, property)));
+        noteVocabulary(model.name, inheritedAndOwnProperties(program, model).map((property) => rawPropertyKey(program, property)));
     }
     return found;
 }
@@ -326,15 +538,76 @@ export function withDeclarationSite(site, run) {
 export function refusalTarget(type) {
     return type.node === undefined ? (declarationSite ?? type) : type;
 }
+/**
+ * **The external document a type is published as a reference to**, by `@useRef`: openapi3 writes
+ * `$ref: <url>` wherever it is used and no component, so the document states no schema this emitter
+ * can read. Read off the decorator applied, as `@typespec/openapi3`, which declares it, is no
+ * dependency of this package.
+ */
+export function externalReferenceOf(type) {
+    if (!("decorators" in type))
+        return undefined;
+    const applied = type.decorators.find((each) => each.decorator.name === "$useRef");
+    if (applied === undefined)
+        return undefined;
+    const [argument] = applied.args;
+    return typeof argument?.jsValue === "string" ? argument.jsValue : "an external document";
+}
+/** Refuse a type the document publishes only as a reference to another document. */
+export function refuseExternalReference(program, type, url) {
+    return refuse(program, type, `it is published as a reference to ${url}, whose schema the document does not state`, "Remove '@useRef' to have the document and this validator state the model, or validate the value yourself where it is used.");
+}
 /** Refuse `type`, pointing at its declaration, and carry on so the rest is reported too. */
 function refuse(program, type, why, remedy = "") {
-    reportDiagnostic(program, {
-        code: "unsupported-type",
-        target: refusalTarget(type),
-        format: { artefact: "Zod", kind: type.kind, why, remedy },
-    });
+    // Once per declaration, whichever walk reaches it first: both walk every type.
+    const target = refusalTarget(type);
+    if (firstReportOf(program, "unsupported-type", target, `${type.kind} ${why}`)) {
+        reportDiagnostic(program, {
+            code: "unsupported-type",
+            target,
+            format: { artefact: "Zod", kind: type.kind, why, remedy },
+        });
+    }
     return UNREPRESENTABLE;
 }
+/**
+ * Whether a JSON value passes the check a standard scalar emits, asked of that very check: the
+ * table below is code this module writes, so it is compiled once here with the same Zod and run,
+ * rather than restated as a second set of rules that could drift from it. `undefined` where the
+ * scalar has no standard base or no entry.
+ */
+const scalarChecks = new Map();
+function scalarAccepts(program, scalar, json) {
+    /**
+     * **A scalar `@encode`d where it is declared is checked as the scalar it is encoded as**, as
+     * `scalarSchemaOf` validates it: `@encode(unixTimestamp, int32) scalar Ts` holds `1577836800`, and
+     * asked of `utcDateTime`'s ISO check the default `Ts.fromISO(...)` publishes was refused.
+     */
+    const encoding = scalarEncodingOf(program, scalar);
+    if (encoding !== undefined) {
+        return program.checker.isStdType(encoding.encoded)
+            ? scalarAccepts(program, encoding.encoded, json)
+            : undefined;
+    }
+    const base = standardBaseOf(program, scalar);
+    const source = base === undefined ? undefined : SCALARS[base.name];
+    if (base === undefined || source === undefined)
+        return undefined;
+    let check = scalarChecks.get(base.name);
+    if (check === undefined) {
+        check = new Function("z", `return ${source};`)(z);
+        scalarChecks.set(base.name, check);
+    }
+    return check.safeParse(json).success;
+}
+/**
+ * **The Zod a standard scalar becomes, or `undefined` for any other scalar** - looked up only for
+ * the standard library's own: a spec's `scalar uint8 extends string` is a string, and found in this
+ * table by its name it was validated as a byte, refusing every string the document accepts.
+ */
+export function standardScalarSchemaOf(program, scalar) {
+    return program.checker.isStdType(scalar) ? SCALARS[scalar.name] : undefined;
+}
 /** Scalars we accept, and the Zod they become. Keyed by the TypeSpec scalar's declared name. */
 const SCALARS = {
     string: "z.string()",
@@ -452,18 +725,60 @@ export function scalarDocOf(program, scalar) {
     }
     return undefined;
 }
+/**
+ * **The `@encode` a scalar is published under: its own, or the nearest one up its `extends` chain.**
+ *
+ * openapi3 builds a scalar that is not standard from its base's schema - encoding included - and
+ * then applies its own decorators over it, so `scalar TsChild extends Ts` with
+ * `@encode(unixTimestamp, int32)` on `Ts` is published as an integer, exactly as `Ts` is. This read
+ * the scalar's own `@encode` alone, so `TsChild` was validated as an ISO date-time string, refusing
+ * every value the document accepts and accepting every value it refuses. `link` is the scalar that
+ * declares the encoding.
+ */
+export function scalarEncodingOf(program, scalar) {
+    for (let link = scalar; link !== undefined; link = link.baseScalar) {
+        const encoded = encodedTypeOf(program, link);
+        if (encoded !== undefined)
+            return { link, encoded };
+    }
+    return undefined;
+}
 /** A scalar's schema without its description, for a position that publishes its own. */
 function scalarSchemaOf(program, scalar) {
     // `scalar unixTimestamp32 is utcDateTime;` with `@encode(int32)` on the SCALAR, not on each use.
-    const encoded = encodedTypeOf(program, scalar);
-    if (encoded !== undefined && encoded !== scalar) {
+    const encoding = scalarEncodingOf(program, scalar);
+    if (encoding !== undefined) {
+        const { link, encoded } = encoding;
+        /**
+         * **An encoding to a scalar that is not standard publishes no type**, so there is no wire form
+         * to validate - including a scalar encoded as itself, which openapi3 publishes as
+         * `{ format: "y" }` alone. A scalar from the standard library carries no `@encode` of its own,
+         * so refusing this at the first link is also what ends every chain: `Ping -> Pong -> Ping` is
+         * refused at `Ping`, where it used to be followed until the stack overflowed.
+         */
+        if (!program.checker.isStdType(encoded)) {
+            reportUnsatisfiableEncoding(program, link, {
+                name: link.name,
+                declared: link.baseScalar?.name ?? link.name,
+                encoded: encoded.name,
+                why: "typeless",
+            });
+            return UNREPRESENTABLE;
+        }
+        /**
+         * The constraints are read from the scalar named, up its chain, and each one the encoded type
+         * cannot carry is dropped and reported by `applyConstraints`: openapi3 applies them BEFORE the
+         * encoding replaces `type`, so a `@pattern` on a string encoded as `int32` is published beside
+         * `type: integer`, where JSON Schema ignores it. Applied, it emitted `z.int32().regex(...)`,
+         * and the module threw on import.
+         */
         return applyConstraints(program, scalarSchemaOf(program, encoded), scalar);
     }
     let current = scalar;
     // Walk the `extends` chain so a named scalar (`scalar chNumber extends string`) resolves to the
     // primitive it is built on rather than being rejected for having a project-specific name.
     while (current !== undefined) {
-        const mapped = SCALARS[current.name];
+        const mapped = standardScalarSchemaOf(program, current);
         // Constraints are read from the scalar the property NAMED, not from the primitive it resolves
         // to, so `@pattern(...) scalar TrimmedString extends string` carries its rules to every use.
         if (mapped !== undefined)
@@ -556,12 +871,55 @@ export function withSyntheticDeclarations(hook, run) {
     }
 }
 const capitalise = (value) => value.charAt(0).toUpperCase() + value.slice(1);
-/** Whether a variant already carries the discriminator, under its declared or its wire name. */
-function declaresDiscriminator(program, variant, property) {
+/**
+ * **Why a variant of an envelope-less `@discriminated` union cannot be dispatched to by its wire
+ * discriminator, or `undefined` where it can.** The variant must carry the discriminator under its
+ * WIRE name, as one fixed value. Matched on the TypeSpec name as well, a variant whose `kind` was
+ * renamed `t` passed, and the module threw "Invalid discriminated union option" on import; one
+ * inheriting an open `type: string` threw on every parse.
+ */
+export function undeclaredVariantOf(program, variant, property) {
     if (variant.kind !== "Model")
-        return false;
-    return inheritedAndOwnProperties(variant).some((candidate) => candidate.name === property ||
-        resolveEncodedName(program, candidate, JSON_MEDIA_TYPE) === property);
+        return "missing";
+    const entry = publishedPropertiesOf(program, variant).find((candidate) => rawPropertyKey(program, candidate.property) === property);
+    if (entry === undefined)
+        return "missing";
+    if (fixedValuesOf(entry.property.type) === undefined)
+        return "open";
+    // A value a declaration above the variant refuses: no value is one.
+    return positionOf(program, variant, entry).never ? "refused" : undefined;
+}
+/**
+ * **The variants a `@discriminated` union dispatches to: each but one no value can be.**
+ *
+ * A variant without an envelope that accepts nothing - its fixed discriminator refused by a
+ * declaration above it, `kind: "cobra"` under `@maxLength(3) kind: string`, or a key it requires
+ * refused by a base openapi3 seals - is published by the document as a member no value satisfies, and
+ * a `oneOf` with such a member accepts what the others accept. Refusing the union for it refused every
+ * `asp` the document accepts, and dispatching to it put a `z.never()` where Zod reads a literal: the
+ * first parse threw "Invalid discriminated union option".
+ */
+export function dispatchedVariantsOf(program, union) {
+    const [discriminated] = getDiscriminatedUnion(program, union);
+    if (discriminated === undefined)
+        return [];
+    const { envelope, discriminatorPropertyName } = discriminated.options;
+    return [...discriminated.variants.entries()]
+        .map(([name, variant]) => [String(name), variant])
+        .filter(([, variant]) => envelope !== "none" ||
+        /**
+         * A refused discriminator leaves values where it may be left out: under a PATCH,
+         * `NCUpdate` accepts `{}`, which matches `NAUpdate` too, so the document's `DNUpdate`
+         * refuses it. Dropped, `DNUpdate` was `NAUpdate` and accepted it.
+         */
+        ((undeclaredVariantOf(program, variant, discriminatorPropertyName) !== "refused" ||
+            optionalDiscriminator(program, union, variant, discriminated.options)) &&
+            !(variant.kind === "Model" && acceptsNothing(program, variant)) &&
+            !isPublishedSplit(program, variant, renderedVisibilityOf(program, variant, visibility))));
+}
+/** A model no value is, refused on its own - `invalid-subtype-discriminator`, `sealed-base-extended`. */
+function acceptsNothing(program, model) {
+    return (unsatisfiableSubtype(program, model) || sealedBaseExtensionOf(program, model)?.required === true);
 }
 /**
  * One variant of a `@discriminated` union, as it appears ON THE WIRE.
@@ -580,18 +938,84 @@ function declaresDiscriminator(program, variant, property) {
  * emitted **only when the variant declares that property itself**. Otherwise the document does not
  * publish it and the union is refused; see `undeclared-discriminator`.
  */
+/**
+ * **Whether a required property is optional at `at`**: a PATCH with implicit optionality, outside a
+ * list's elements - `@typespec/http`'s `isOptional`, for a property with no declaration of its own
+ * to ask, as an envelope's are.
+ */
+export function implicitlyOptional(at) {
+    return ((at & Visibility.Update) !== 0 && (at & Visibility.Patch) !== 0 && (at & Visibility.Item) === 0);
+}
+/**
+ * **The visibility an envelope is published at, within a union rendered at the current one.**
+ * openapi3 synthesises the envelope as a model of two properties - the discriminator and the variant
+ * - and emits it from the union's context, which reduces it to `Read` unless it is transformed
+ * there: where the variant is, or where a PATCH makes both its properties optional. Read as one
+ * envelope for every visibility, a PATCH body was held to the read wrapper's required `kind` and
+ * `value`, and a response to the create wrapper's variant.
+ */
+export function envelopeVisibilityOf(program, union, variant) {
+    /**
+     * **The union is reduced first**, as openapi3 reduces any reference to it: a union not
+     * transformed where it is reached is emitted at `Read`, its envelopes with it. Spelled out inside a
+     * merge under a PATCH, `DU { a: A, b: B }` of all-optional variants had its envelopes' `kind` and
+     * `value` made optional, where the document's `DUA` requires both.
+     */
+    const at = renderedVisibilityOf(program, union, visibility);
+    if (at === Visibility.Read)
+        return Visibility.Read;
+    const reshaped = (variant.kind === "Model" || variant.kind === "Union") && isTransformedBy(program, variant, at);
+    return reshaped || implicitlyOptional(at) ? at : Visibility.Read;
+}
+/** Whether a variant's discriminator may be absent where the union is rendered - see `unionToZod`. */
+export function optionalDiscriminator(program, union, variant, options) {
+    if (options.envelope !== "none")
+        return implicitlyOptional(envelopeVisibilityOf(program, union, variant));
+    if (variant.kind !== "Model")
+        return false;
+    const at = renderedVisibilityOf(program, variant, visibility);
+    const property = inheritedAndOwnProperties(program, variant).find((each) => each.name === options.discriminatorPropertyName);
+    return property !== undefined && (property.optional || implicitlyOptional(at));
+}
 function discriminatedVariant(program, union, variantName, variant, options) {
-    const inner = typeToZod(program, variant);
-    const tag = `${objectKey(options.discriminatorPropertyName)}: z.literal(${literal(variantName)})`;
+    const { value: inner, deferred } = captureBackEdges(() => typeToZod(program, variant));
+    const envelopeAt = envelopeVisibilityOf(program, union, variant);
+    const optional = implicitlyOptional(envelopeAt) ? ".exactOptional()" : "";
+    const tag = `${objectKey(options.discriminatorPropertyName)}: z.literal(${literal(variantName)})${optional}`;
     // The variant already carries the discriminator, so the document publishes it and there is
     // nothing to add.
-    if (options.envelope === "none")
+    if (options.envelope === "none") {
+        if (deferred)
+            noteBackEdge();
         return inner;
-    const wrapper = `${sealObjectSchemas ? "z.strictObject" : "z.object"}({ ${tag}, ${objectKey(options.envelopePropertyName)}: ${inner} })`;
-    const name = `${union.name ?? ""}${capitalise(variantName)}`;
-    if (union.name === undefined)
+    }
+    /**
+     * **A variant still being declared is reached through a getter**, as an object's member is: the
+     * wrapper is a declaration of its own, and read eagerly it met `catSchema` before its `const` -
+     * "Cannot access 'catSchema' before initialization" on import, for a `Cat` that refers back to the
+     * union through its own properties.
+     */
+    const key = objectKey(options.envelopePropertyName);
+    const value = deferred
+        ? `get ${key}()${optional === "" ? (annotateDeferredType(variant) ?? "") : ""} { return ${inner}${optional}; }`
+        : `${key}: ${inner}${optional}`;
+    const wrapper = `${sealObjectSchemas ? "z.strictObject" : "z.object"}({ ${tag}, ${value} })`;
+    const name = envelopeNameOf(program, union, variantName, variant);
+    if (name === undefined)
         return wrapper;
-    return declareSynthetic?.(name, () => wrapper) ?? wrapper;
+    return declareSynthetic?.(name, () => wrapper, union) ?? wrapper;
+}
+/**
+ * **The component openapi3 publishes an envelope as**: the union's name and the variant's, suffixed
+ * with the envelope's visibility where the union - whose usage openapi3 gives the envelope - is used
+ * at more than one. None for a union with no name, whose envelopes are written out where it is.
+ */
+export function envelopeNameOf(program, union, variantName, variant) {
+    if (union.name === undefined)
+        return undefined;
+    const envelopeAt = envelopeVisibilityOf(program, union, variant);
+    const suffixed = envelopeAt !== Visibility.Read && isSuffixedByUsage(union);
+    return `${union.name}${capitalise(variantName)}${suffixed ? getVisibilitySuffix(envelopeAt, Visibility.Read) : ""}`;
 }
 function unionToZod(program, union) {
     /**
@@ -619,43 +1043,151 @@ function unionToZod(program, union) {
          * reader. A validator may only enforce what the document says.
          */
         if (options.envelope === "none") {
-            const undeclared = [...discriminated.variants.values()].filter((variant) => !declaresDiscriminator(program, variant, options.discriminatorPropertyName));
-            if (undeclared.length > 0) {
+            const undeclared = [...discriminated.variants.values()]
+                .map((variant) => ({
+                variant,
+                why: undeclaredVariantOf(program, variant, options.discriminatorPropertyName),
+            }))
+                .filter(({ why }) => why === "missing" || why === "open");
+            const [first] = undeclared;
+            if (first !== undefined) {
                 reportDiagnostic(program, {
                     code: "undeclared-discriminator",
+                    messageId: first.why === "open" ? "open" : "default",
                     target: union,
                     format: {
                         name: union.name ?? "an anonymous union",
                         property: options.discriminatorPropertyName,
-                        variant: undeclared[0]?.name ?? "one of its variants",
+                        variant: first.variant.name ?? "one of its variants",
                     },
                 });
                 return UNREPRESENTABLE;
             }
         }
-        const members = [...discriminated.variants.entries()].map(([name, variant]) => discriminatedVariant(program, union, name, variant, options));
+        const dispatched = dispatchedVariantsOf(program, union);
+        // A variant left out for a key its sealed base refuses is refused as itself, as anywhere else.
+        for (const variant of discriminated.variants.values()) {
+            if (variant.kind === "Model")
+                reportSealedBaseExtended(program, variant);
+        }
+        const kept = dispatched
+            .map(([name, variant]) => ({
+            variant,
+            member: discriminatedVariant(program, union, name, variant, options),
+        }))
+            .filter(({ member }) => !held.refused(member));
+        const members = kept.map(({ member }) => member);
+        // Every variant refused by a declaration above it: the document accepts no value either.
+        if (members.length === 0)
+            return UNREPRESENTABLE;
         const property = options.discriminatorPropertyName;
-        return `z.discriminatedUnion(${literal(property)}, [${members.join(", ")}])`;
+        /**
+         * **A discriminator a PATCH makes optional dispatches nothing**: `z.discriminatedUnion` reads
+         * one fixed value per member, and the document publishes `oneOf` - exactly one member - which
+         * with the tag absent is what `z.xor` checks. As a dispatch, `{ value: {...} }` was refused.
+         */
+        if (dispatched.some(([, variant]) => optionalDiscriminator(program, union, variant, options))) {
+            return members.length === 1 ? members[0] : `z.xor([${members.join(", ")}])`;
+        }
+        /**
+         * **A variant no dispatch can hold sits beside it**, as a nested base does beside a base's own
+         * dispatch: one with no envelope that is a `@discriminator` base itself, a `z.union` with no
+         * literal to read, and one annotated for its recursion. In the dispatch, every parse threw
+         * "Invalid discriminated union option". Each fixes a value of its own, so at most one matches.
+         */
+        const beside = kept
+            .filter(({ variant, member }) => held.annotated(member) ||
+            (options.envelope === "none" &&
+                variant.kind === "Model" &&
+                discriminatedBaseOf(program, variant) !== undefined))
+            .map(({ member }) => member);
+        const dispatch = members.filter((member) => !beside.includes(member));
+        if (beside.length === 0) {
+            return `z.discriminatedUnion(${literal(property)}, [${members.join(", ")}])`;
+        }
+        const arms = [
+            ...(dispatch.length === 0
+                ? []
+                : [`z.discriminatedUnion(${literal(property)}, [${dispatch.join(", ")}])`]),
+            ...beside,
+        ];
+        return arms.length === 1 ? arms[0] : `z.xor([${arms.join(", ")}])`;
     }
     const variants = [...union.variants.values()].map((variant) => variant.type);
-    const nullable = variants.some((type) => type.kind === "Intrinsic" && type.name === "null");
-    const real = variants.filter((type) => !(type.kind === "Intrinsic" && type.name === "null"));
-    if (real.length === 0) {
-        reportDiagnostic(program, {
-            code: "empty-union",
-            target: union,
-            format: { why: "every variant is `null`" },
-        });
-        return UNREPRESENTABLE;
-    }
-    const suffix = nullable ? ".nullable()" : "";
-    if (real.every((type) => type.kind === "String")) {
-        const literals = real.map((type) => literal(type.value));
-        return `z.enum([${literals.join(", ")}])${suffix}`;
+    const nulls = variants.filter(isNull).length;
+    const real = variants.filter((type) => !isNull(type));
+    const exclusive = isExclusive(program, union) || exclusiveSite === union;
+    /**
+     * **Asked once the members are written**: writing one declares it, and a declaration openapi3
+     * publishes split is refused only as it is written. Asked first, `@oneOf { v0: float, v1: M10, v2:
+     * M11 }` held the `M10` refused while it was written, and the contract type, walked after every
+     * refusal, was `never` - `wire-contract.gen.ts` did not compile (`TS2344`).
+     */
+    const written = (() => {
+        // A raw `bytes` member of a multipart part's union is any value - see `withMultipartBinary`.
+        const memberToZod = (type) => multipartBinary && isRawBytes(program, type) ? "z.unknown()" : typeToZod(program, type);
+        /**
+         * **A `@oneOf` refuses the `null` more than one of its members matches**: openapi3 publishes
+         * each `null` variant as a `{ type: "null" }` of its own, beside members that may admit it too -
+         * `unknown | null` is `oneOf [{}, null]`, which no `null` passes. Each is a `z.null()` member of
+         * the `z.xor`, which counts as the document does; `.nullable()` passed `null` before either.
+         */
+        if (exclusive &&
+            nulls > 0 &&
+            (nulls > 1 || real.some((type) => admitsNullValue(program, type)))) {
+            const members = [...literalGroupsOf(real, memberToZod), ...Array(nulls).fill("z.null()")];
+            return `z.xor([${members.join(", ")}])`;
+        }
+        // `null | null` is `null`, as the document reads it - and `q: null` was never refused.
+        if (real.length === 0)
+            return "z.null()";
+        const suffix = nulls > 0 ? ".nullable()" : "";
+        if (real.every((type) => type.kind === "String")) {
+            const literals = real.map((type) => literal(type.value));
+            return `z.enum([${literals.join(", ")}])${suffix}`;
+        }
+        if (real.length === 1)
+            return `${memberToZod(real[0])}${suffix}`;
+        /**
+         * **Every literal of one JSON kind is one member of a `@oneOf`**, as openapi3 publishes it - one
+         * `enum` per kind: `1` repeated is matched once, where two `z.literal(1)` matched it twice.
+         */
+        const members = exclusive ? literalGroupsOf(real, memberToZod) : real.map(memberToZod);
+        if (members.length === 1)
+            return `${members[0]}${suffix}`;
+        return `${exclusive ? "z.xor" : "z.union"}([${members.join(", ")}])${suffix}`;
+    })();
+    return holdsRefusedMember(program, union, exclusive) ? UNREPRESENTABLE : written;
+}
+/** A union's members as Zod, its literals of each JSON kind as one member where the first one stands. */
+function literalGroupsOf(types, memberToZod) {
+    const groups = new Map();
+    const members = [];
+    for (const type of types) {
+        const value = type.kind === "EnumMember" ? undefined : literalValueOf(type);
+        if (value === undefined) {
+            members.push(memberToZod(type));
+            continue;
+        }
+        const kind = typeof value;
+        const group = groups.get(kind);
+        if (group === undefined) {
+            groups.set(kind, [value]);
+            members.push({ group: kind });
+        }
+        else if (!group.includes(value))
+            group.push(value);
     }
-    if (real.length === 1)
-        return `${typeToZod(program, real[0])}${suffix}`;
-    return `z.union([${real.map((type) => typeToZod(program, type)).join(", ")}])${suffix}`;
+    return members.map((member) => {
+        if (typeof member === "string")
+            return member;
+        const values = groups.get(member.group) ?? [];
+        if (values.every((each) => typeof each === "string")) {
+            return `z.enum([${values.map((each) => literal(each)).join(", ")}])`;
+        }
+        const literals = values.map((each) => `z.literal(${literal(each)})`);
+        return literals.length === 1 ? literals[0] : `z.union([${literals.join(", ")}])`;
+    });
 }
 /**
  * TypeSpec models arrays and dictionaries as a `Model` carrying an **indexer**.
@@ -694,230 +1226,1858 @@ function isUnknownType(type) {
  * refers back to the derived model - `type/model/inheritance/recursive`, the exact case - would throw
  * during module initialisation. Flattening asks nothing of the base but its properties.
  */
-export function inheritedAndOwnProperties(model) {
+export function inheritedAndOwnProperties(program, model) {
+    return flattenedPropertiesOf(program, model).map((entry) => entry.property);
+}
+export function flattenedPropertiesOf(program, model) {
     const chain = [];
     for (let link = model; link !== undefined; link = link.baseModel) {
         chain.unshift(link);
     }
-    // Base first, so a derived model REDECLARING a property overrides rather than duplicates it.
-    const byName = new Map();
+    // Base first, so a derived model REDECLARING a key overrides rather than duplicates it.
+    const byKey = new Map();
     for (const link of chain) {
-        for (const property of link.properties.values())
-            byName.set(property.name, property);
+        for (const property of link.properties.values()) {
+            const key = rawPropertyKey(program, property);
+            const declarations = byKey.get(key) ?? [];
+            // Two keys of one name in one model: openapi3 writes the later over the earlier.
+            if (declarations.at(-1)?.model === link)
+                declarations.pop();
+            declarations.push({ model: link, property });
+            byKey.set(key, declarations);
+        }
     }
-    return [...byName.values()];
+    return [...byKey.values()].map((declarations) => ({
+        property: declarations.at(-1).property,
+        overridden: declarations
+            .slice(0, -1)
+            .reverse()
+            .map((declaration) => declaration.property),
+    }));
 }
-/** The indexer in force, which a model can inherit - `model X extends Record<unknown>`. */
-export function effectiveIndexer(model) {
-    for (let link = model; link !== undefined; link = link.baseModel) {
-        if (link.indexer !== undefined)
-            return link.indexer;
+/**
+ * The keys a model publishes at the current position, each with every declaration of it the
+ * document holds the value to - its most derived published declaration first.
+ *
+ * **A declaration counts where openapi3 publishes it, and only there.** Each model in the chain is
+ * published as `allOf` the one above, and each judges its own properties at the position: a
+ * `@header` or a create-only property above a response is in no schema the response is held to, so
+ * its `@maxLength` bounds nothing there; a `never` or an invisible redeclaration drops out of its own
+ * model's schema and leaves the key to the ones above it. Judged on the most derived declaration
+ * alone, the first was enforced where the document does not, and the second dropped a key the base
+ * still requires.
+ *
+ * **HTTP metadata is not payload.** A `@header` or `@statusCode` property describes the envelope, so
+ * it never appears in the body: RFC 9457 puts `@header("content-type") contentType:
+ * "application/problem+json"` on the problem model, the document described a body without it, and
+ * this emitter required `contentType` as a member. **A `never` property is dropped, as the document
+ * drops it**: `model N { value: never; other: string }` is published as `{other}`, and a validator
+ * keeping `value: z.never()` refused `{"other": "x"}`, the exact body the document describes.
+ */
+export function publishedPropertiesOf(program, model) {
+    return declarationsWhere(program, model, (declaration) => atPublication(program, declaration, () => isPayloadProperty(program, declaration)));
+}
+/**
+ * **The keys a model's `required` is read from: each declaration at the visibility its model is
+ * rendered at**, where openapi3 reduces the reference - see `contentMisreadingsOf`. Wider than
+ * {@link publishedPropertiesOf} where a read-only declaration drops out of the properties openapi3
+ * reads at a create body's visibility, and stays required at `Read`.
+ */
+function renderedPropertiesOf(program, model) {
+    return declarationsWhere(program, model, (declaration) => atDeclaration(program, declaration, () => isPayloadProperty(program, declaration)));
+}
+function declarationsWhere(program, model, present) {
+    const published = [];
+    for (const entry of flattenedPropertiesOf(program, model)) {
+        const [property, ...overridden] = [entry.property, ...entry.overridden].filter((declaration) => present(declaration) && !isNeverType(declaration.type));
+        if (property !== undefined)
+            published.push({ property, overridden });
     }
-    return undefined;
+    return published;
 }
 /**
- * The subtypes a `@discriminator` base stands for, in declaration order.
- *
- * Filtered by openapi3's own {@link includeDerivedModel} so a template declaration is not mistaken
- * for a real subtype - the same rule that decides whether a base may be sealed.
+ * **A declaration is in its model's schema where openapi3 reads that model's properties: at the
+ * visibility the reference it writes the model from arrived at** - see `readVisibilityOf` - not the
+ * one it reduces that to. `X { @visibility(Read) @maxLength(2) id: string; ...Record<string> }`
+ * first sent in a create body is published without `id` in its properties, so its indexer holds the
+ * `id` its `required` names; validated by the read-only declaration, `"abcdef"` was refused. Likewise
+ * a base's `id`, or the `string` openapi3 adds for a discriminator, holds a key whose read-only
+ * declaration drops out.
  */
-export function discriminatedSubtypes(program, model) {
-    if (getDiscriminator(program, model) === undefined)
-        return [];
-    return model.derivedModels.filter((derived) => includeDerivedModel(derived));
+function atPublication(program, property, run) {
+    const model = property.model;
+    if (model === undefined)
+        return run();
+    // Of several views under one name, the one the document keeps - see `keptVisibilityOf`.
+    const rendered = keptVisibilityOf(model, renderedVisibilityOf(program, model, visibility));
+    return withVisibility(readVisibilityOf(program, model, rendered, metadataIgnored), run);
 }
-function modelToZod(program, model) {
+/**
+ * The discriminators a model is published under: its own and every one up its chain, by wire name.
+ * openapi3 lists each in its base's `required`, and the base applies through `allOf`.
+ */
+export function discriminatorsOf(program, model) {
+    const names = [];
+    for (let link = model; link !== undefined; link = link.baseModel) {
+        const discriminator = getDiscriminator(program, link);
+        if (discriminator !== undefined && !names.includes(discriminator.propertyName)) {
+            names.push(discriminator.propertyName);
+        }
+    }
+    return names;
+}
+export const OWN_POSITION = {
+    constrainedBy: [],
+    required: false,
+    stringOnly: false,
+    never: false,
+    nullOnly: false,
+    nonNull: false,
+    value: undefined,
+    ancestors: [],
+    refused: undefined,
+};
+export function positionOf(program, model, entry) {
+    const key = rawPropertyKey(program, entry.property);
+    return positionOfDeclarations(program, entry.property, entry.overridden, {
+        required: discriminatorsOf(program, model).includes(key),
+        injected: injectedDiscriminatorsOf(program, model).includes(key),
+        beside: [],
+    });
+}
+/**
+ * The position of `own` beneath `ancestors`, the declarations of one key the document holds its
+ * value to, plus `beside`: what no declaration states - a typed indexer of a model merged with it, an
+ * envelope's members.
+ */
+function positionOfDeclarations(program, own, ancestors, options) {
+    const position = {
+        ...OWN_POSITION,
+        ancestors,
+        required: options.required || ancestors.some((ancestor) => isRequiredAt(program, ancestor)),
+        ...(options.at?.[0] === undefined ? {} : { at: options.at[0] }),
+    };
+    const beside = options.beside.filter((part) => !isTypelessPart(program, part) || part.keywords.length > 0);
+    const atOf = (index) => options.at?.[index];
+    const ownAt = atOf(0) ?? visibility;
     /**
-     * **A `@discriminator` base is a CHOICE between its subtypes, not a shape of its own.**
-     *
-     * `@discriminator("kind") model Bird { kind: string; wingspan: int32 }` with four models extending
-     * it reaches OpenAPI as a component carrying `discriminator: {propertyName, mapping}`, and the
-     * mapping is an instruction: validate the body against whichever subtype the discriminator names.
-     * Emitting the base's own properties instead produced `z.object({kind: z.string(), wingspan})`,
-     * which accepts `{kind: "eagle"}` while ignoring everything `Eagle` actually declares - a
-     * polymorphic endpoint validating none of its polymorphism.
-     *
-     * `z.discriminatedUnion` is the faithful encoding and composes both ways this corpus needs.
-     * Measured on Zod 4.4.3: a union may be an OPTION of another union, which is how
-     * `Fish -> Shark -> SawShark` works; and an option carrying a getter that refers back to the union
-     * being defined does **not** throw, because the discriminator is read without enumerating the rest
-     * of the shape. `Eagle.friends?: Bird[]` is exactly that, and it decides whether polymorphism and
-     * recursion can coexist at all.
+     * **A key one declaration states is still published at that declaration's visibility**: `M5`'s
+     * `e: M6`, merged at `Read` beside `M4Update`, is `M6`, and rendered at the merge's own `Update`
+     * it was `M6Update`, which accepts the `{}` that `M6` refuses.
      */
-    const subtypes = discriminatedSubtypes(program, model);
-    if (subtypes.length > 0) {
-        // `discriminatedSubtypes` is empty unless the model has a discriminator.
-        const discriminator = getDiscriminator(program, model)?.propertyName ?? "";
-        const options = subtypes.map((derived) => typeToZod(program, derived));
-        return `z.discriminatedUnion(${literal(discriminator)}, [${options.join(", ")}])`;
+    const apart = ownAt !== visibility &&
+        renderedVisibilityOf(program, nullableInnerOf(own.type) ?? own.type, ownAt) !==
+            renderedVisibilityOf(program, nullableInnerOf(own.type) ?? own.type, visibility);
+    if (ancestors.length === 0 && !options.injected && beside.length === 0 && !apart) {
+        return position;
     }
-    const indexer = effectiveIndexer(model);
-    const indexerKey = indexer?.key.name;
-    const declared = inheritedAndOwnProperties(model);
-    if (indexerKey === "integer" && indexer !== undefined) {
-        return applyConstraints(program, `z.array(${typeToZod(program, indexer.value)})`, model);
+    // Reported and refused by its own walk - see `unsatisfiable-encoding`.
+    if (encodedValueOf(program, own).kind === "unsatisfiable")
+        return position;
+    const constrainedBy = [];
+    let never = false;
+    let nullOnly = false;
+    let nonNull = false;
+    let merge = beside.length > 0 || apart;
+    for (const [index, ancestor] of ancestors.entries()) {
+        /**
+         * **A declaration published at another visibility is merged, unless its type is one schema at
+         * both**: `In` in a list literal's element is published at `Update | Item` and in a named list's
+         * at `Update`, and taken as narrowed by itself it was `InUpdate` alone, `x` optional where the
+         * element requires it.
+         */
+        const ancestorAt = atOf(index + 1) ?? visibility;
+        const declared = nullableInnerOf(ancestor.type) ?? ancestor.type;
+        if (ancestorAt !== ownAt &&
+            renderedVisibilityOf(program, declared, ancestorAt) !==
+                renderedVisibilityOf(program, declared, ownAt)) {
+            merge = true;
+            continue;
+        }
+        if (elementsPublishedApart(program, nullableInnerOf(own.type) ?? own.type, ownAt, declared, ancestorAt)) {
+            merge = true;
+            continue;
+        }
+        const verdict = overrideVerdictOf(program, own, ancestor);
+        if (verdict.kind === "never")
+            never = true;
+        else if (verdict.kind === "null")
+            nullOnly = true;
+        else if (verdict.kind === "merge")
+            merge = true;
+        else {
+            constrainedBy.push(...verdict.constrainedBy);
+            nonNull ||= verdict.nonNull;
+        }
     }
-    /**
-     * **A string indexer only means "dictionary" when the model declares NO properties.**
-     *
-     * `model X { id: string; ...Record<unknown> }` - the standard TypeSpec way to say "these fields,
-     * plus anything else", and what `@loose` was replaced by - carries both. Returning
-     * `z.record(...)` for it emits a schema that accepts an object and then **strips every declared
-     * field**, so `respond()`'s drift detection degrades to "is it an object" and the pinned fields
-     * silently stop being checked. This function's own history is the other half of the same mistake:
-     * it once keyed on the model's *name*, and lost the indexer of anything derived from `Record`.
-     */
-    if (indexerKey === "string" && indexer !== undefined && declared.length === 0) {
-        return applyConstraints(program, `z.record(z.string(), ${withDeclarationSite(model, () => typeToZod(program, indexer.value))})`, model);
+    if (never)
+        return { ...position, never: true };
+    if (merge) {
+        const withAt = (declaration, index) => {
+            const part = partOfProperty(program, declaration);
+            const at = atOf(index);
+            return part === undefined || at === undefined ? part : { ...part, at };
+        };
+        const value = mergeParts(program, [
+            ...[own, ...ancestors].map(withAt),
+            ...(options.injected ? [stringPart(program)] : []),
+            ...beside,
+        ]);
+        const refusal = refusalIn(value);
+        return {
+            ...position,
+            value,
+            never: value.kind === "never",
+            refused: refusal === undefined
+                ? undefined
+                : {
+                    ancestor: ancestors[0] ?? own,
+                    why: refusal.why,
+                    recursive: refusal.recursive === true,
+                },
+        };
     }
+    let stringOnly = false;
+    if (options.injected) {
+        const types = valueJsonTypesOf(program, own);
+        if (types === undefined)
+            stringOnly = true;
+        else if (!types.has("string"))
+            never = true;
+        else
+            stringOnly = [...types].some((type) => type !== "string");
+        nonNull ||= admitsNull(program, own);
+    }
+    return { ...position, constrainedBy, stringOnly, never, nullOnly, nonNull };
+}
+/** Whether a declaration requires its key at the current position. */
+function isRequiredAt(program, property) {
+    return !(property.optional || atDeclaration(program, property, () => isOptionalAt(program, property)));
+}
+/**
+ * **A declaration is judged at the visibility its own model is rendered at**, as openapi3 renders
+ * each model of a chain: a subtype's create body is `allOf` its base, and a base with nothing
+ * create-specific is the canonical schema - its read-only `id` shared in, `readOnly` and required.
+ * Judged at the subtype's visibility, the base's `id` dropped out of the create body the document
+ * requires it in. See `renderedVisibilityOf`.
+ */
+/** At the visibility a merged member's declaration is published at, where it is not the merge's. */
+export function atPosition(position, run) {
+    return position.at === undefined ? run() : withVisibility(position.at, run);
+}
+export function atDeclaration(program, property, run) {
+    const model = property.model;
+    // Of several views under one name, the one the document keeps - see `keptVisibilityOf`.
+    return model === undefined
+        ? run()
+        : withVisibility(keptVisibilityOf(model, renderedVisibilityOf(program, model, visibility)), run);
+}
+/**
+ * **A property's type is referred to at the visibility openapi3 reads its declaration's properties
+ * at** - see `readVisibilityOf` - where the declaration is rendered at the current one. Its
+ * optionality and its position stay where the model is published; only what the type is named, a
+ * list or a union instance openapi3 does not reduce, can differ.
+ */
+export function atReading(program, property, run) {
+    const model = property.model;
+    if (model === undefined)
+        return run();
+    const read = readVisibilityOf(program, model, visibility, metadataIgnored);
+    return read === visibility ? run() : withVisibility(read, run);
+}
+/** Whether a declaration's value may be `null`, as the document publishes it. */
+function admitsNull(program, property) {
+    const encoding = encodedValueOf(program, property);
+    if (encoding.kind === "replaced" || encoding.kind === "both")
+        return encoding.nullable;
+    if (encoding.kind === "unsatisfiable")
+        return false;
+    return admitsNullValue(program, property.type, exclusiveAt(program, property));
+}
+/** Whether a property's value is a `@oneOf`: its union's own, or its own on its inline union. */
+function exclusiveAt(program, property) {
+    const type = property.type;
+    return (isExclusive(program, type) ||
+        (isExclusive(program, property) && type.kind === "Union" && type.name === undefined));
+}
+/**
+ * **`T | null` read as `T` beside its `null`** - unless it is a `@oneOf` whose `T` takes `null`
+ * too, which then refuses it: `@oneOf unknown | null` is `oneOf [{}, null]`, and no `null` passes.
+ */
+function peeledNullOf(program, property) {
+    const inner = nullableInnerOf(property.type);
+    return inner !== undefined && exclusiveAt(program, property) && admitsNullValue(program, inner)
+        ? undefined
+        : inner;
+}
+/**
+ * **Whether two lists' elements are published at visibilities their types differ at**: a list
+ * literal's element at `Item`, a named list's at the list's own. Under a PATCH, `u: El[]` over
+ * `u: Els` holds each element to `El` and to `ElUpdate`, and taken as narrowed by the element type
+ * alone it was `El`, sealed against the `c` that `InnerUpdate` refuses.
+ */
+function elementsPublishedApart(program, own, ownAt, ancestor, ancestorAt) {
+    const elementOf = (list, at) => {
+        if (list.kind !== "Model" || effectiveIndexer(list)?.key.name !== "integer")
+            return undefined;
+        const element = effectiveIndexer(list).value;
+        return { element, at: isArrayLiteral(program, list) ? at | Visibility.Item : at };
+    };
+    const one = elementOf(own, ownAt);
+    const other = elementOf(ancestor, ancestorAt);
+    if (one === undefined || other === undefined || one.at === other.at)
+        return false;
+    return [one.element, other.element].some((element) => renderedVisibilityOf(program, element, one.at) !==
+        renderedVisibilityOf(program, element, other.at));
+}
+/** How one declaration above an overriding one bears on its value - see {@link PropertyPosition}. */
+function overrideVerdictOf(program, own, ancestor) {
+    if (disjoint(program, own, ancestor))
+        return { kind: "never" };
+    const ancestorEncoding = encodedValueOf(program, ancestor);
+    if (ancestorEncoding.kind === "unsatisfiable")
+        return { kind: "never" };
+    const ownEncoding = encodedValueOf(program, own);
+    // An encoding that keeps its declared type beside another holds the value to both, whole.
+    if (ownEncoding.kind === "both" || ancestorEncoding.kind === "both")
+        return { kind: "merge" };
     /**
-     * Permissiveness, read from the INDEXER and from nothing else.
-     *
-     * `...Record<unknown>` is the standard TypeSpec construct and the one `@typespec/openapi3` can
-     * see, so it is the only source. There was a second - `@loose`, a decorator of ours, invisible to
-     * the document - and it is gone: a model that accepted unknown properties while the published
-     * schema said otherwise is a runtime disagreeing with its own contract.
-     *
-     * An indexer over something other than `unknown` is a typed catchall, where `.loose()` would drop
-     * that value type on the floor.
-     */
-    /**
-     * **`Record<never>` is how a spec says "and nothing else", not a value type to walk.**
-     *
-     * `model A { ...Record<never>; name: string }` gives an indexer whose value is the `never`
-     * intrinsic. Read as an ordinary typed catchall it became `.catchall(z.never())`, which reached
-     * `typeToZod` and refused the whole compile - while `@typespec/openapi3` publishes the same model
-     * cleanly as `additionalProperties: {not: {}}`, with no diagnostic at all. `isSealed` already reads
-     * a `never` indexer as sealed; this stops the catchall branch consuming it first.
-     */
-    const indexerValue = indexerKey === "string" && indexer !== undefined && !isNeverType(indexer.value)
-        ? indexer.value
-        : undefined;
-    const suffix = indexerValue !== undefined && isUnknownType(indexerValue)
-        ? ".loose()"
-        : indexerValue === undefined
-            ? ""
-            : `.catchall(${withDeclarationSite(model, () => typeToZod(program, indexerValue))})`;
-    /**
-     * A request model REJECTS an unrecognised field rather than stripping it.
-     *
-     * Silently dropping something a caller sent is the same failure this whole surface exists to
-     * remove, one layer out: the request succeeds and does less than it was asked to, with nothing
-     * anywhere reporting it. `appointedOn` went missing for exactly that reason and surfaced as a
-     * confusing downstream 400 instead of a loud one naming the key.
+     * `null` is a value of its own: no keyword applies to it, and it is valid on both sides only
+     * where both admit it. An override of `null` alone narrows an ancestor admitting it.
      */
-    const strict = suffix === "" && isSealed(model) ? ".strict()" : "";
+    const ownNull = admitsNull(program, own);
+    const ancestorNull = admitsNull(program, ancestor);
+    const nonNull = ownNull && !ancestorNull;
+    const implied = { kind: "implied", constrainedBy: [], nonNull };
+    if (isNull(own.type))
+        return ancestorNull ? implied : { kind: "never" };
     /**
-     * **HTTP metadata is not payload.** A `@header` or `@statusCode` property describes the envelope,
-     * so it never appears in the body - `@typespec/openapi3` strips it from the schema it emits, and a
-     * validator that kept it would demand a field the wire never carries.
-     *
-     * Found the moment a model carried its own content-type: RFC 9457 puts
-     * `@header("content-type") contentType: "application/problem+json"` on the problem model, the
-     * document correctly described a body without it, and this emitter produced
-     * `contentType: z.literal(...)` as a required member. Two artefacts from one source, disagreeing
-     * about the shape of a body - the exact contradiction ADR 0005 exists to make impossible.
+     * A literal is judged now, value by value: against the ancestor's constraints and its declared
+     * type, as JSON Schema would. Every value admitted leaves nothing to apply; none admitted leaves
+     * `null` where both sides allow it, and no value otherwise. Values some of which the ancestor's
+     * own keywords refuse are narrowed member by member - see `constrainedMembersOf` - and values its
+     * TYPE refuses are merged out.
      */
+    const literals = literalValuesOfType(own.type);
+    if (literals !== undefined) {
+        const ancestorType = ancestorEncoding.kind === "replaced" ? ancestorEncoding.scalar : ancestor.type;
+        const byType = literals.filter((value) => admitsValue(program, ancestorType, value));
+        const admitted = byType.filter((value) => brokenConstraintOf(program, ancestor, value) === undefined);
+        if (admitted.length === literals.length)
+            return implied;
+        if (admitted.length === 0) {
+            return ownNull && ancestorNull ? { kind: "null" } : { kind: "never" };
+        }
+        if (byType.length === literals.length) {
+            return { kind: "implied", constrainedBy: [ancestor], nonNull };
+        }
+        return { kind: "merge" };
+    }
+    const ownType = ownEncoding.kind === "replaced" ? ownEncoding.scalar : (peeledNullOf(program, own) ?? own.type);
+    const ancestorType = ancestorEncoding.kind === "replaced"
+        ? ancestorEncoding.scalar
+        : (peeledNullOf(program, ancestor) ?? ancestor.type);
+    const narrowed = narrowsTo(program, ownType, ancestorType);
+    if (narrowed === undefined)
+        return { kind: "merge" };
+    return {
+        kind: "implied",
+        constrainedBy: [...(hasConstraints(program, ancestor) ? [ancestor] : []), ...narrowed],
+        nonNull,
+    };
+}
+/**
+ * **Whether every value of `own` is a value of `ancestor`**, and the declared scalars whose rules
+ * are left to apply - or `undefined` where neither one validator can say. A scalar narrows by
+ * TypeSpec's own assignability, plus the rules of any declared scalar above it; a model only by
+ * extending; a list by its element; a union where some member does.
+ */
+function narrowsTo(program, own, ancestor) {
+    if (own === ancestor)
+        return [];
+    if (own.kind === "UnionVariant")
+        return narrowsTo(program, own.type, ancestor);
+    if (ancestor.kind === "UnionVariant")
+        return narrowsTo(program, own, ancestor.type);
+    // A union with an envelope is published as its wrappers, which no variant type is.
+    if (isEnveloped(program, own) || isEnveloped(program, ancestor))
+        return undefined;
+    // A literal narrows whatever admits its value, read statically.
+    const value = literalValueOf(own);
+    if (value !== undefined)
+        return admitsValue(program, ancestor, value) ? [] : undefined;
+    if (own.kind === "Union") {
+        const scalars = [];
+        for (const member of membersOf(own)) {
+            // A `null` the ancestor refuses - a list's element, a record's value - is merged out.
+            if (isNull(member)) {
+                if (hasNull(ancestor) || isTypelessMember(program, ancestor))
+                    continue;
+                return undefined;
+            }
+            const each = narrowsTo(program, member, ancestor);
+            if (each === undefined)
+                return undefined;
+            scalars.push(...each);
+        }
+        return scalars;
+    }
+    switch (ancestor.kind) {
+        case "Scalar": {
+            if (own.kind !== "Scalar")
+                return undefined;
+            if (!isAssignable(program, own, ancestor) && !checksNoMoreThan(program, own, ancestor)) {
+                return undefined;
+            }
+            return program.checker.isStdType(ancestor) ? [] : [ancestor];
+        }
+        case "Tuple": {
+            if (own.kind !== "Tuple" || own.values.length !== ancestor.values.length)
+                return undefined;
+            const each = own.values.map((value, index) => narrowsTo(program, value, ancestor.values[index]));
+            return each.every((value) => value !== undefined && value.length === 0) ? [] : undefined;
+        }
+        case "Model": {
+            // A record of what narrows the ancestor's record's values, with no rules of its own to add.
+            if (ancestor.indexer?.key.name === "string" &&
+                ancestor.properties.size === 0 &&
+                own.kind === "Model" &&
+                own.indexer?.key.name === "string" &&
+                own.properties.size === 0) {
+                const value = narrowsTo(program, own.indexer.value, ancestor.indexer.value);
+                return value !== undefined && value.length === 0 ? [] : undefined;
+            }
+            const ancestorElement = ancestor.indexer?.key.name === "integer" ? ancestor.indexer.value : undefined;
+            if (ancestorElement !== undefined) {
+                const ownElement = own.kind === "Model" && own.indexer?.key.name === "integer"
+                    ? own.indexer.value
+                    : undefined;
+                if (ownElement === undefined)
+                    return undefined;
+                // An element's own rules cannot be added to a list's: only a list of what it already is.
+                const element = narrowsTo(program, ownElement, ancestorElement);
+                if (element === undefined || element.length > 0)
+                    return undefined;
+                // A named list model's own `@minItems` and `@maxItems` still hold - `b: Duo` under `Pair`.
+                return hasConstraints(program, ancestor) ? [ancestor] : [];
+            }
+            for (let link = own.kind === "Model" ? own : undefined; link; link = link.baseModel) {
+                if (link === ancestor)
+                    return [];
+            }
+            return undefined;
+        }
+        /**
+         * **Into a union, only where the member it narrows says everything left to apply.** A member it
+         * narrows wholly - itself, or a standard scalar - leaves nothing; ONE member it narrows with
+         * rules of its own leaves those. Two such members are two alternatives - `Digits2` under
+         * `Lower | Digits` is a `Digits2` that is a `Lower` OR a `Digits` - which no list of rules says,
+         * so the declarations are merged member by member instead. Taking the first, `Digits2` was held
+         * to `Lower`'s pattern and `Digits`' at once, and accepted nothing.
+         */
+        case "Union":
+        case "Enum": {
+            // Into `@oneOf`, a value of the override may match two members, which the document refuses.
+            if (isExclusive(program, ancestor))
+                return undefined;
+            /**
+             * **Into a `@discriminated` union - a `oneOf` too - only where its discriminator tells every
+             * variant apart.** Where one may leave it out - `kind?`, or any under a PATCH - `{}` is an `NA`
+             * and an `NB`, which the document refuses: narrowed to `NA` under `DN`, it was accepted.
+             */
+            if (ancestor.kind === "Union") {
+                const [discriminated] = getDiscriminatedUnion(program, ancestor);
+                if (discriminated !== undefined &&
+                    [...discriminated.variants.values()].some((variant) => optionalDiscriminator(program, ancestor, variant, discriminated.options))) {
+                    return undefined;
+                }
+            }
+            const members = alikeMembersOf(program, ancestor);
+            const narrowed = members.map((member) => narrowsTo(program, own, member));
+            if (narrowed.some((each) => each !== undefined && each.length === 0))
+                return [];
+            const narrowing = narrowed.flatMap((each, index) => (each === undefined ? [] : [index]));
+            if (narrowing.length !== 1)
+                return undefined;
+            const [index] = narrowing;
+            /**
+             * The one member's rules say everything only where no other member takes a value of it too:
+             * `string` under `"green" | Short` is `"green"` OR a `Short`, and held to `Short`'s
+             * `@maxLength` alone it refused the `"green"` both declarations accept.
+             */
+            return members.some((member, other) => other !== index && overlaps(program, own, member))
+                ? undefined
+                : narrowed[index];
+        }
+        case "Intrinsic":
+            return ancestor.name === "unknown" ? [] : undefined;
+        default:
+            return undefined;
+    }
+}
+/**
+ * Whether a value of `own` may be a value of `member` too, as far as their JSON types and a literal
+ * tell - taken as so where either has no type to tell by.
+ */
+function overlaps(program, own, member) {
+    const value = literalValueOf(member);
+    if (value !== undefined)
+        return admitsValue(program, own, value);
+    const ownTypes = jsonTypesOf(program, own);
+    const memberTypes = jsonTypesOf(program, member);
+    if (ownTypes === undefined || memberTypes === undefined)
+        return true;
+    const numeric = (type) => type === "integer" || type === "number" || type === "fraction";
+    return [...ownTypes].some((one) => [...memberTypes].some((other) => one === other || (numeric(one) && numeric(other))));
+}
+/**
+ * **Whether a scalar's own check says everything another's does**, where TypeSpec's assignability
+ * does not: `int32` under `float`, whose schema is only `type: number`, and `offsetDateTime` under
+ * `utcDateTime`, which are checked alike. The other's own keywords are still applied, as the rules
+ * of a declared scalar above it.
+ */
+function checksNoMoreThan(program, own, ancestor) {
+    if (scalarEncodingOf(program, own) !== undefined)
+        return false;
+    if (scalarEncodingOf(program, ancestor) !== undefined)
+        return false;
+    const ownBase = standardBaseOf(program, own);
+    const ancestorBase = standardBaseOf(program, ancestor);
+    if (ownBase === undefined || ancestorBase === undefined)
+        return false;
+    const ownCheck = SCALARS[ownBase.name];
+    const ancestorCheck = SCALARS[ancestorBase.name];
+    if (ownCheck === undefined || ancestorCheck === undefined)
+        return false;
+    if (ownCheck === ancestorCheck)
+        return true;
+    const json = jsonTypeOfScalar(program, ancestorBase);
+    return (json !== undefined && ancestorCheck === BARE_CHECKS[json] && isWithin(program, ownBase, json));
+}
+/** The schema that checks a JSON type and nothing more. */
+const BARE_CHECKS = {
+    string: "z.string()",
+    number: "z.number()",
+    boolean: "z.boolean()",
+};
+/** The standard scalar a scalar is built on. */
+function standardBaseOf(program, scalar) {
+    for (let link = scalar; link !== undefined; link = link.baseScalar) {
+        if (program.checker.isStdType(link))
+            return link;
+    }
+    return undefined;
+}
+/** A `@discriminated` union with an envelope, whose members the document publishes as wrappers. */
+function isEnveloped(program, type) {
+    if (type.kind !== "Union")
+        return false;
+    const [discriminated] = getDiscriminatedUnion(program, type);
+    return discriminated !== undefined && discriminated.options.envelope !== "none";
+}
+/**
+ * **Whether a union reaches itself through union members alone**: `union string { int32, string }`
+ * in a namespace, where the member `string` names the union and not the scalar, or `A { int32, B }`
+ * beside `B { string, A }`. No property or list element stands between the union and its own
+ * reference, so the schema openapi3 publishes, `anyOf: [int32, { $ref: string }]`, refers to itself
+ * with no value passed through on the way, and JSON Schema leaves that undefined - measured, Ajv
+ * overflows its stack on `5`, `"abc"` and `null` alike. TypeScript refuses the alias it would be,
+ * and the walks here that flatten a union recursed until the compiler reported "Emitter crashed!
+ * This is a bug." A union with an envelope wraps each member in an object, which a value does pass
+ * through, so the walk stops there.
+ */
+export function reachesItselfThroughUnions(program, union) {
+    const seen = new Set();
+    const visit = (each) => {
+        if (isEnveloped(program, each) || seen.has(each))
+            return false;
+        seen.add(each);
+        return [...each.variants.values()].some(({ type }) => {
+            let member = type;
+            while (member.kind === "UnionVariant")
+                member = member.type;
+            return member === union || (member.kind === "Union" && visit(member));
+        });
+    };
+    return visit(union);
+}
+/** Refuse a union that reaches itself through union members alone - see `reachesItselfThroughUnions`. */
+export function refuseSelfReachingUnion(program, union) {
+    refuse(program, union, `its members reach '${getTypeName(union)}' again through unions alone, so the schema '@typespec/openapi3' publishes for it refers to itself with no value passed through on the way, which JSON Schema leaves undefined`, "If a member is meant to name another type, qualify it, as 'TypeSpec.string' names the scalar; if the recursion is meant, hold it in a model property or a list.");
+}
+/** TypeSpec's own assignability, which an override is checked against and a rename is not. */
+export function isAssignable(program, source, target) {
+    return $(program).type.isAssignableTo(source, target);
+}
+function isNull(type) {
+    return type.kind === "Intrinsic" && type.name === "null";
+}
+/** Whether a type admits `null`: it is `null`, or a union with `null` among its members. */
+function hasNull(type) {
+    return membersOf(type).some(isNull);
+}
+/** The fixed values of a type that is literals and nothing else, `null` aside; else `undefined`. */
+function literalValuesOfType(type) {
+    const members = membersOf(type).filter((member) => !(member.kind === "Intrinsic" && member.name === "null"));
+    const values = members.map(literalValueOf);
+    return values.length > 0 && values.every((value) => value !== undefined)
+        ? values
+        : undefined;
+}
+/**
+ * Whether a declared type admits a literal value.
+ *
+ * **A scalar admits what the check it emits admits** - see `scalarAccepts` - not every value of its
+ * JSON type: `"red"` is a string and no `utcDateTime`. Read by type alone, `@oneOf { Color, string }`
+ * merged with `k: utcDateTime` kept `"red"` and `"green"` as members of their own, and a value the
+ * document finds in two members was accepted as one.
+ */
+function admitsValue(program, type, value) {
+    switch (type.kind) {
+        case "UnionVariant":
+            return admitsValue(program, type.type, value);
+        case "Scalar": {
+            const json = jsonTypeOfScalar(program, type);
+            const kind = typeof value === "number"
+                ? Number.isInteger(value)
+                    ? "integer"
+                    : "fraction"
+                : typeof value;
+            const fits = json === undefined ||
+                json === kind ||
+                (json === "number" && (kind === "integer" || kind === "fraction"));
+            return (fits &&
+                brokenConstraintOf(program, type, value) === undefined &&
+                scalarAccepts(program, type, value) !== false);
+        }
+        case "String":
+        case "Number":
+        case "Boolean":
+            return type.value === value;
+        case "EnumMember":
+            return (type.value ?? type.name) === value;
+        case "Enum":
+            return membersOf(type).some((member) => admitsValue(program, member, value));
+        case "Union": {
+            // Under `@oneOf`, a value two members admit is no value of the union.
+            const admitting = alikeMembersOf(program, type).filter((member) => admitsValue(program, member, value));
+            return isExclusive(program, type) ? admitting.length === 1 : admitting.length > 0;
+        }
+        case "Intrinsic":
+            return type.name === "unknown";
+        default:
+            return false;
+    }
+}
+/** Whether two declarations of one key share no JSON type, so no value is both. */
+function disjoint(program, one, other) {
+    const a = valueJsonTypesOf(program, one);
+    const b = valueJsonTypesOf(program, other);
+    if (a === undefined || b === undefined)
+        return false;
+    const numeric = (type) => type === "integer" || type === "number" || type === "fraction";
+    return ![...a].some((x) => [...b].some((y) => x === y || (numeric(x) && numeric(y))));
+}
+/** The JSON types a property's value is published as, `@encode` included; `undefined` for any. */
+function valueJsonTypesOf(program, property) {
+    const encoding = encodedValueOf(program, property);
+    if (encoding.kind === "replaced" || encoding.kind === "both") {
+        const json = jsonTypeOfScalar(program, encoding.scalar);
+        if (json === undefined)
+            return undefined;
+        return new Set(encoding.nullable ? [json, "null"] : [json]);
+    }
+    return jsonTypesOf(program, property.type);
+}
+/**
+ * The discriminators openapi3 adds to a model as a required `string`: each `@discriminator` in the
+ * chain whose model's OWN payload properties lack it.
+ */
+function injectedDiscriminatorsOf(program, model) {
+    const names = [];
+    for (let link = model; link !== undefined; link = link.baseModel) {
+        const discriminator = getDiscriminator(program, link);
+        if (discriminator === undefined)
+            continue;
+        // Read where openapi3 reads the model's properties: a read-only `kind` sent in a create body is not.
+        const declared = [...link.properties.values()].some((property) => atPublication(program, property, () => isPayloadProperty(program, property)) &&
+            !isNeverType(property.type) &&
+            rawPropertyKey(program, property) === discriminator.propertyName);
+        if (!declared)
+            names.push(discriminator.propertyName);
+    }
+    return names;
+}
+const NOTHING = { kind: "never" };
+/** No value because a declaration is refused - see `HeldDeclarations.refusedAt`. */
+const WITHHELD = { kind: "never", withheld: true };
+/** The part a property publishes: its declared type, or its encoded one, with its keywords. */
+function partOfProperty(program, property) {
+    const encoding = encodedValueOf(program, property);
+    switch (encoding.kind) {
+        case "unsatisfiable":
+            return undefined;
+        case "both":
+            return { members: [], nullable: false, keywords: [], whole: property };
+        case "replaced":
+            return {
+                members: [encoding.scalar],
+                nullable: encoding.nullable,
+                keywords: [property],
+                type: encoding.scalar,
+            };
+        case "declared":
+            return partOfType(program, property.type, [property], exclusiveSiteOf(program, property, property.type) !== undefined);
+    }
+}
+/**
+ * The part a declared type is, its members spelled out. `exclusiveHere` where the property declaring
+ * it makes its inline union a `oneOf` - see `exclusiveSiteOf`: merged under a redeclaration, `@oneOf
+ * u: X1 | X2` was an `anyOf`, and `{ u: {} }`, which both members match, was accepted.
+ */
+function partOfType(program, type, keywords, exclusiveHere = false) {
     /**
-     * **A property that refers back into an unfinished declaration is emitted as a GETTER.**
-     *
-     * `model InnerModel { children?: InnerModel[] }` is a plain recursive tree, and openapi3 publishes
-     * it as a self-`$ref`. Emitting `children: z.array(innerModelSchema)` reads the `const` inside its
-     * own initialiser, so the module throws on import; deferring the reference behind a getter is the
-     * idiom Zod documents for exactly this, and it is the only one that keeps `z.infer` inferring the
-     * recursive type rather than collapsing to `any`. `z.lazy(() => innerModelSchema)` runs correctly
-     * but does not typecheck - measured: `TS7022`, "implicitly has type 'any' because it does not have
-     * a type annotation and is referenced directly or indirectly in its own initializer".
+     * A `@discriminated` union is published as `oneOf` too: its tag makes the members disjoint, until
+     * a PATCH makes the tag optional, and `{ value: { a: "s" } }` then matches two open envelopes.
      */
-    const members = declared
-        .filter((property) => isPayloadProperty(program, property))
+    const exclusive = exclusiveHere ||
+        isExclusive(program, type) ||
+        (type.kind === "Union" && getDiscriminatedUnion(program, type)[0] !== undefined);
+    const members = [];
+    /**
+     * **How many members a `null` matches**, a nested union's included: kept whole, its `null` set
+     * nothing, and `@oneOf { v0: float | null, v1: string }` refused the `null` it accepts. Under
+     * `@oneOf` it is a value where exactly one member matches it.
+     */
+    let nullMatches = 0;
+    let refused;
+    const visit = (each) => {
+        if (each.kind === "UnionVariant")
+            return visit(each.type);
+        if (isNull(each)) {
+            nullMatches += 1;
+            return;
+        }
+        if (each.kind === "Union") {
+            // A nested union is one member, whole, unless both are `anyOf` - see `alikeMembersOf`.
+            if (each !== type && (exclusive || isPublishedOneOf(program, each))) {
+                if (admitsNullValue(program, each))
+                    nullMatches += 1;
+                members.push(each);
+                return;
+            }
+            const [discriminated] = getDiscriminatedUnion(program, each);
+            if (discriminated !== undefined && discriminated.defaultVariant !== undefined) {
+                refused = "it is a discriminated union with a default variant";
+            }
+            if (discriminated !== undefined && discriminated.options.envelope !== "none") {
+                for (const [name, variant] of discriminated.variants) {
+                    members.push({
+                        kind: "Envelope",
+                        union: each,
+                        name: String(name),
+                        variant,
+                        discriminator: discriminated.options.discriminatorPropertyName,
+                        property: discriminated.options.envelopePropertyName,
+                    });
+                }
+                return;
+            }
+            for (const variant of each.variants.values())
+                visit(variant.type);
+            return;
+        }
+        if (each.kind === "Enum") {
+            members.push(...each.members.values());
+            return;
+        }
+        if (isTypelessMember(program, each))
+            nullMatches += 1;
+        members.push(each);
+    };
+    visit(type);
+    return {
+        members: exclusive ? withoutRepeatedLiterals(members) : members,
+        nullable: exclusive ? nullMatches === 1 : nullMatches > 0,
+        keywords,
+        type,
+        ...(refused === undefined ? {} : { refused }),
+        ...(exclusive ? { exclusive: true } : {}),
+    };
+}
+/** The `string` openapi3 adds as a discriminator where the model declaring it does not. */
+function stringPart(program) {
+    const string = program.checker.getStdType("string");
+    return { members: [string], nullable: false, keywords: [], type: string };
+}
+function isEnvelope(member) {
+    return member.kind === "Envelope";
+}
+/** A part with no JSON type of its own, which asserts only its keywords on whatever the value is. */
+function isTypelessPart(program, part) {
+    return (part.whole === undefined &&
+        part.members.length > 0 &&
+        // `@oneOf { a: unknown, b: unknown }` is two members, which every value matches: none passes.
+        !(part.exclusive === true && part.members.length > 1) &&
+        part.members.every((member) => !isEnvelope(member) && isTypelessMember(program, member)));
+}
+/** Merges in flight, so one that reaches itself again is refused rather than followed forever. */
+const mergesInFlight = [];
+export function mergeParts(program, given) {
+    if (given.some((part) => part === undefined))
+        return NOTHING;
+    const parts = given;
+    const refused = parts.find((part) => part.refused !== undefined)?.refused;
+    if (refused !== undefined)
+        return { kind: "refused", why: refused };
+    const wholes = parts.filter((part) => part.whole !== undefined);
+    if (wholes.length > 0) {
+        const others = parts.filter((part) => part.whole === undefined);
+        return {
+            kind: "all",
+            parts: [
+                ...wholes.map((part) => ({ kind: "whole", property: part.whole })),
+                ...(others.length === 0 ? [] : [mergeParts(program, others)]),
+            ],
+        };
+    }
+    const keywordsOnly = parts.filter((part) => isTypelessPart(program, part));
+    const typed = parts.filter((part) => !isTypelessPart(program, part));
+    const loose = keywordsOnly.flatMap((part) => part.keywords);
+    if (typed.length === 0) {
         /**
-         * **A `never` property is DROPPED, exactly as the document drops it.** `model N { value:
-         * never; other: string }` is published by `@typespec/openapi3` as `{other}` with
-         * `required: ["other"]` - `value` is absent entirely, because a property that can hold no value
-         * is not part of the payload.
-         *
-         * This emitter kept it and wrote `value: z.never()`, which made the model unsatisfiable: measured,
-         * `{"other":"x"}` - the exact body the document describes - was REJECTED with "expected never,
-         * received undefined". So the validator generated from a document rejected every request that
-         * document calls valid, which is the divergence class this package exists to prevent.
-         *
-         * Dropping it makes the two artefacts agree and leaves nothing to refuse. `never` in a position
-         * that is not a property - a body, a variant - is still refused by `typeToZodBody`, because there
-         * it is not something the document quietly omits.
+         * **A `@oneOf` of a typeless member and `null` refuses the `null` both match**, and is its own
+         * union, whole: `@oneOf { a: unknown, b: null }` beside `unknown` accepted `null` as keywords.
          */
-        .filter((property) => !isNeverType(property.type))
-        .map((property) => {
-        const key = propertyKey(program, property);
-        const { value, deferred } = captureBackEdges(() => withDeclarationSite(property, () => propertyToZod(program, property)));
+        const nonNull = keywordsOnly.find((part) => !part.nullable && part.type !== undefined);
+        if (nonNull !== undefined) {
+            return { kind: "type", type: nonNull.type, keywords: loose };
+        }
+        const first = keywordsOnly[0]?.members[0] ?? $(program).intrinsic.any;
+        return { kind: "type", type: first, keywords: loose };
+    }
+    // A typeless part admits `null` unless it is such a `@oneOf`, whose refusal stands.
+    const nullable = parts.every((part) => part.nullable);
+    if (typed.some((part) => part.members.length === 0)) {
+        return nullable ? nullValue(program) : NOTHING;
+    }
+    const [first, ...rest] = typed;
+    const value = mergeNonNull(program, [
+        { ...first, keywords: [...first.keywords, ...loose] },
+        ...rest,
+    ]);
+    return nullable ? orNullMerged(program, value) : value;
+}
+function nullValue(program) {
+    return { kind: "type", type: $(program).intrinsic.null, keywords: [] };
+}
+function orNullMerged(program, value) {
+    if (value.kind === "never")
+        return nullValue(program);
+    if (value.kind === "type" && hasNull(value.type))
+        return value;
+    return { kind: "nullable", inner: value };
+}
+/** Parts that each admit no `null`, and are each one or more members. */
+function mergeNonNull(program, parts) {
+    /**
+     * **A member with no type asserts only its keywords**, here as at the top of a merge: split out of
+     * `@oneOf { v0: unknown, v1: string }` beside an envelope, `unknown` reached the intersection of two
+     * scalars and was refused as an unknown kind, `Envelope`, where the value is the envelope.
+     */
+    const typeless = parts.filter((part) => isTypelessPart(program, part));
+    if (typeless.length > 0 && typeless.length < parts.length) {
+        const [first, ...rest] = parts.filter((part) => !isTypelessPart(program, part));
+        const loose = typeless.flatMap((part) => part.keywords);
+        return mergeNonNull(program, [{ ...first, keywords: [...first.keywords, ...loose] }, ...rest]);
+    }
+    const keywords = parts.flatMap((part) => part.keywords);
+    const [only] = parts;
+    if (parts.length === 1 && only !== undefined && only.members.length === 1) {
+        const member = only.members[0];
+        return isEnvelope(member)
+            ? mergeObjects(program, [only])
+            : memberValue(program, member, only.keywords, only.at);
+    }
+    if (disjointParts(program, parts))
+        return NOTHING;
+    // A part whose type every other part's admits is the value, every part's keywords on it.
+    for (const candidate of parts) {
+        const type = typeOfPart(candidate);
+        if (type === undefined)
+            continue;
+        const scalars = [];
+        const narrows = parts.every((other) => {
+            if (other === candidate)
+                return true;
+            const target = typeOfPart(other);
+            const each = target === undefined || !publishedAlike(program, target, candidate, other)
+                ? undefined
+                : narrowsTo(program, type, target);
+            if (each !== undefined)
+                scalars.push(...each);
+            return each !== undefined;
+        });
+        if (narrows)
+            return memberValue(program, type, [...keywords, ...scalars], candidate.at);
+    }
+    /**
+     * **A nested union kept whole is spelled out where it meets another declaration**, its members
+     * held to the rest with its own exclusivity: `C` beside `@oneOf { v0: A | B, v1: string }` is
+     * `C & A` or `C & B`. Left whole, the two objects were joined with `.and()`, which pooled the keys
+     * a sealed side refuses and threw on the two defaults of `k`.
+     */
+    const nested = parts.findIndex((part) => part.members.length === 1 &&
+        !isEnvelope(part.members[0]) &&
+        part.members[0].kind === "Union");
+    if (nested !== -1) {
+        const part = parts[nested];
+        const spelled = partOfType(program, part.members[0], part.keywords);
+        if (spelled.members.length === 0)
+            return NOTHING;
+        return mergeNonNull(program, parts.map((each, index) => index === nested ? { ...spelled, ...(part.at === undefined ? {} : { at: part.at }) } : each));
+    }
+    // A union is held to the rest member by member, and a member nothing else admits is dropped.
+    const split = parts.findIndex((part) => part.members.length > 1);
+    if (split !== -1) {
+        const union = parts[split];
+        const members = union.members.map((member) => mergeNonNull(program, parts.map((part, index) => index === split
+            ? {
+                members: [member],
+                nullable: false,
+                keywords: union.keywords,
+                ...(union.at === undefined ? {} : { at: union.at }),
+            }
+            : part)));
         /**
-         * **A getter without a return type infers `unknown`, and the collapse is SILENT.**
-         *
-         * The docblock above claims the getter keeps `z.infer` inferring the recursive type. It does
-         * for the declaration itself, and not for a schema that WRAPS it: measured on the conformance
-         * corpus, `z.record(z.string(), innerModelSchema)` - what `@body body: Record<InnerModel>`
-         * emits - infers `children?: unknown`, and `.parse()` on it returns `unknown` outright. The
-         * generated server then failed to compile with `TS2322`, in `type/dictionary`, which is how
-         * this was found; nothing said the emitted TYPE was weaker than the document.
-         *
-         * Annotating the GETTER rather than the declaration is what keeps `.shape` and `.extend`,
-         * which inheritance and every group spread depend on. `: z.ZodType<T, T>` names both of Zod's
-         * parameters for the reason `renderSchemas` names both: one leaves the input side `unknown`.
+         * **A `@oneOf` holding a refused member validates nothing**: the document still counts the
+         * member, so a value it and another both match is refused there, and dropped here it was
+         * accepted - as a merge holding a refused declaration holds nothing.
          */
-        const annotation = deferred ? (annotateDeferred(property) ?? "") : "";
+        const refusal = members.find(holdsRefusal);
+        if (union.exclusive === true && refusal !== undefined)
+            return heldRefusalOf(refusal);
+        const kept = members.filter((member) => member.kind !== "never");
+        const [one] = kept;
+        if (one === undefined)
+            return NOTHING;
+        // A `@oneOf` union stays exclusive member by member: each merged member matches where its own did.
+        if (kept.length === 1)
+            return one;
+        return union.exclusive === true
+            ? { kind: "union", members: kept, exclusive: true }
+            : { kind: "union", members: kept };
+    }
+    const members = parts.map((part) => part.members[0]);
+    const fixed = members.find((member) => !isEnvelope(member) && literalValueOf(member) !== undefined);
+    if (fixed !== undefined) {
+        const value = literalValueOf(fixed);
+        const admitted = members.every((member) => !isEnvelope(member) && admitsValue(program, member, value));
+        const kept = keywords.every((source) => brokenConstraintOf(program, source, value) === undefined);
+        return admitted && kept ? { kind: "type", type: fixed, keywords: [] } : NOTHING;
+    }
+    if (members.every((member) => isObjectMember(member)))
+        return mergeObjects(program, parts);
+    if (members.every((member) => !isEnvelope(member) && isListMember(member))) {
+        return mergeLists(program, parts);
+    }
+    if (members.some((member) => !isEnvelope(member) && member.kind === "Tuple")) {
+        return { kind: "refused", why: "a tuple is held to another declaration" };
+    }
+    // Two scalars of one JSON type that neither narrows: the value is checked against both.
+    return {
+        kind: "all",
+        parts: parts.map((part) => memberValue(program, part.members[0], part.keywords, part.at)),
+    };
+}
+/**
+ * **Whether a type is one schema at the visibility each of two parts is published at**, so that
+ * what narrows it at one narrows it at the other. A record's value is published at the record's
+ * visibility: `QX { x: M1 }` sent in a PATCH beside a `Record<M1>` holds `x` to `M1Update` and to
+ * `M1`, and taken as narrowed by itself it was `M1Update` alone, `c` optional where `M1` requires it.
+ */
+function publishedAlike(program, type, one, other) {
+    const a = one.at ?? visibility;
+    const b = other.at ?? visibility;
+    if (a !== b &&
+        renderedVisibilityOf(program, type, a) !== renderedVisibilityOf(program, type, b)) {
+        return false;
+    }
+    const own = typeOfPart(one);
+    return own === undefined || !elementsPublishedApart(program, own, a, type, b);
+}
+/** The one type a part stands for, where it can be rendered whole: a single member, or its union. */
+function typeOfPart(part) {
+    if (part.members.length === 1) {
+        const [member] = part.members;
+        return member === undefined || isEnvelope(member) ? undefined : member;
+    }
+    if (part.members.some(isEnvelope))
+        return undefined;
+    return part.type !== undefined && !hasNull(part.type) ? part.type : undefined;
+}
+/**
+ * A member as the value, its keywords on it - a literal checked against them now - published at
+ * `at` where its part is published apart from the merge: a record's value, at the record's.
+ */
+function memberValue(program, type, keywords, at) {
+    const value = literalValueOf(type);
+    if (value === undefined)
+        return { kind: "type", type, keywords, ...(at === undefined ? {} : { at }) };
+    return keywords.every((source) => brokenConstraintOf(program, source, value) === undefined)
+        ? { kind: "type", type, keywords: [] }
+        : NOTHING;
+}
+/** Whether the parts share no JSON type, so no value is one of each. */
+function disjointParts(program, parts) {
+    const typesOf = (part) => {
+        const types = new Set();
+        for (const member of part.members) {
+            const each = isEnvelope(member)
+                ? new Set(["object"])
+                : jsonTypesOf(program, member);
+            if (each === undefined)
+                return undefined;
+            for (const type of each)
+                types.add(type);
+        }
+        return types;
+    };
+    const numeric = (type) => type === "integer" || type === "number" || type === "fraction";
+    let shared;
+    for (const part of parts) {
+        const types = typesOf(part);
+        if (types === undefined)
+            continue;
+        shared =
+            shared === undefined
+                ? [...types]
+                : shared.filter((type) => [...types].some((other) => other === type || (numeric(other) && numeric(type))));
+    }
+    return shared !== undefined && shared.length === 0;
+}
+function isObjectMember(member) {
+    if (isEnvelope(member))
+        return true;
+    return member.kind === "Model" && effectiveIndexer(member)?.key.name !== "integer";
+}
+function isListMember(member) {
+    return member.kind === "Model" && effectiveIndexer(member)?.key.name === "integer";
+}
+/** Lists merged element by element, with every declaration's list keywords. */
+function mergeLists(program, parts) {
+    const lists = parts.map((part) => part.members[0]);
+    // Array literals all, the element is an `Item`'s - see `atItem`.
+    const [first] = lists;
+    const literal = lists.every((list) => isArrayLiteral(program, list)) ? first : undefined;
+    // Each list's element at its own visibility - a literal's with `Item`, a named list's without.
+    const merge = () => mergeParts(program, lists.map((list, index) => {
+        const at = parts[index]?.at ?? visibility;
         return {
-            deferred,
-            text: deferred
-                ? `\tget ${key}()${annotation} {\n\t\treturn ${value};\n\t},`
-                : `\t${key}: ${value},`,
+            ...partOfType(program, effectiveIndexer(list).value, []),
+            at: isArrayLiteral(program, list) ? at | Visibility.Item : at,
         };
+    }));
+    const element = literal === undefined ? merge() : atItem(program, literal, merge);
+    return {
+        kind: "array",
+        element,
+        keywords: parts.flatMap((part, index) => [...part.keywords, lists[index]]),
+        ...(literal === undefined ? {} : { list: literal }),
+    };
+}
+/**
+ * A model as the object it publishes at the current position, or `undefined` where it accepts
+ * nothing - refused as `invalid-subtype-discriminator` or `sealed-base-extended`.
+ */
+function shapeOfModel(program, model, keywords) {
+    if (unsatisfiableSubtype(program, model))
+        return undefined;
+    const extension = sealedBaseExtensionOf(program, model);
+    if (extension?.required === true)
+        return undefined;
+    const binding = bindingIndexerOf(model);
+    const rest = binding !== undefined && !isNeverType(binding.value) ? binding.value : undefined;
+    /**
+     * The keys the binding indexer's own model and those above it publish, which it does not hold. A
+     * key whose declaration openapi3 leaves out of the properties - see `atPublication` - is the
+     * indexer's: `additionalProperties` evaluates it.
+     */
+    const exempt = binding === undefined
+        ? undefined
+        : new Set(publishedPropertiesOf(program, binding.link).map(({ property }) => rawPropertyKey(program, property)));
+    /**
+     * **A string indexer only means "dictionary" when the model declares NO properties** - read from
+     * the UNFILTERED list, because a model whose only properties are metadata is still a declared
+     * object rather than a dictionary.
+     */
+    const dictionary = rest !== undefined && flattenedPropertiesOf(program, model).length === 0;
+    const discriminators = discriminatorsOf(program, model);
+    const injected = injectedDiscriminatorsOf(program, model);
+    const published = new Map(publishedPropertiesOf(program, model).map((entry) => [
+        rawPropertyKey(program, entry.property),
+        entry,
+    ]));
+    const members = renderedPropertiesOf(program, model)
+        /**
+         * An optional property a template instance adds to a base openapi3 seals is refused by the
+         * document whenever it is sent - see `sealedBaseExtensionOf` - so it is not declared, and the
+         * sealed object refuses it too.
+         */
+        .filter(({ property }) => extension === undefined || !extension.keys.includes(rawPropertyKey(program, property)))
+        .flatMap(({ property, overridden }) => {
+        const key = rawPropertyKey(program, property);
+        const rendered = [property, ...overridden];
+        const bound = binding !== undefined && exempt !== undefined && !exempt.has(key);
+        // `required` is read where the model is reduced to, as openapi3 reads it.
+        const required = discriminators.includes(key) ||
+            rendered.some((declaration) => isRequiredAt(program, declaration));
+        const entry = published.get(key);
+        /**
+         * **A key no published declaration states is held by what covers it in the document**: the
+         * indexer, or the `string` openapi3 adds for a discriminator, below. One nothing covers is
+         * `split-visibility`, refused, and keeps the declaration it was rendered from.
+         */
+        if (entry === undefined && required && discriminators.includes(key))
+            return [];
+        const declarations = entry !== undefined
+            ? [entry.property, ...entry.overridden]
+            : bound && rest !== undefined
+                ? []
+                : rendered;
+        return [
+            {
+                key,
+                declarations,
+                // A key the binding indexer holds is held to its value as well - see `bindingIndexerOf`.
+                beside: bound && rest !== undefined ? [partOfType(program, rest, [])] : [],
+                forbidden: bound && rest === undefined,
+                injected: injected.includes(key),
+                required,
+            },
+        ];
     });
-    const entries = members.map((member) => member.text);
+    // A key a `Record<never>` above it refuses: no value where it is required, refused where sent.
+    if (members.some((member) => member.forbidden && member.required))
+        return undefined;
     /**
-     * A model-level `@refine` goes through the same path as every other constraint, so the predicate's
-     * import is recorded exactly once, in one place. Handling it separately here is what dropped the
-     * import the first time - the emitted schema referenced a name it never imported, and only the
-     * compile check in `test/emit.test.ts` noticed.
-     *
-     * `.refine()` returns an effect rather than an object, so `applyConstraints` appending it after
-     * `.loose()` is also the only order that works.
+     * **The discriminator openapi3 adds where nothing declares it**, a required `string`, on the base
+     * and - through `allOf` - on every model under it, an intermediate subtype standing alone included.
      */
+    for (const key of discriminators) {
+        if (members.some((member) => member.key === key))
+            continue;
+        members.push({
+            key,
+            declarations: [],
+            beside: [stringPart(program)],
+            forbidden: false,
+            injected: false,
+            required: true,
+        });
+    }
+    return {
+        members: members.filter((member) => !member.forbidden),
+        sealed: rest === undefined && (binding !== undefined || isSealed(model)),
+        rest,
+        dictionary,
+        keywords: [...keywords, model],
+        site: model,
+        at: visibility,
+    };
+}
+/**
+ * **The indexer that holds a model's keys: the TOPMOST string indexer in its chain.**
+ *
+ * openapi3 publishes a root model's indexer as `additionalProperties`, which holds every key the
+ * model does not declare itself - a subtype's own keys included, since the subtype is `allOf` the
+ * root - and a lower model's as `unevaluatedProperties`, which the root's has already evaluated. So
+ * the topmost indexer holds every key its own model and those above it do not declare, and any below
+ * it never applies. Read as the nearest, a subtype's `m: Inner2` escaped the base's
+ * `...Record<Inner>` and a subtype's own indexer refused keys the document accepts.
+ */
+export function bindingIndexerOf(model) {
+    let binding;
+    for (let link = model; link !== undefined; link = link.baseModel) {
+        if (link.indexer?.key.name === "string")
+            binding = { link, value: link.indexer.value };
+    }
+    return binding;
+}
+/** The wrapper openapi3 publishes for an envelope, as an object of its two required members. */
+function shapeOfEnvelope(program, envelope) {
+    const tag = $(program).literal.createString(envelope.name);
+    // Published where the union reduces to - see `envelopeVisibilityOf` - not where a merge spells it out.
+    const at = envelopeVisibilityOf(program, envelope.union, envelope.variant);
+    // Both optional where a PATCH makes them so, as the envelope is published.
+    const required = !implicitlyOptional(at);
+    return {
+        members: [
+            {
+                key: envelope.discriminator,
+                declarations: [],
+                beside: [{ members: [tag], nullable: false, keywords: [], type: tag }],
+                injected: false,
+                required,
+            },
+            {
+                key: envelope.property,
+                declarations: [],
+                // At the envelope's visibility: a list literal's at `Item`, beside a named list's without.
+                beside: [{ ...partOfType(program, envelope.variant, []), at }],
+                injected: false,
+                required,
+            },
+        ],
+        sealed: sealObjectSchemas,
+        rest: undefined,
+        dictionary: false,
+        keywords: [],
+        site: envelope.union,
+        at,
+    };
+}
+/** Objects merged key by key - see {@link Merged}. */
+function mergeObjects(program, parts) {
+    const members = parts.map((part) => part.members[0]);
+    if (mergesInFlight.some((entry) => entry.length === members.length && entry.every((member) => members.includes(member)))) {
+        return { kind: "refused", why: "the merged value refers back to itself", recursive: true };
+    }
+    mergesInFlight.push(members);
+    try {
+        const shapes = [];
+        for (const [index, member] of members.entries()) {
+            const part = parts[index];
+            const requested = part.at ?? visibility;
+            const at = isEnvelope(member) ? requested : renderedVisibilityOf(program, member, requested);
+            /**
+             * A component openapi3 publishes split - refused as `split-visibility` wherever it is
+             * rendered - holds a value to a schema no value satisfies, and so does every merge holding it.
+             * Merged from its declared shape, `Sub` accepted what its `allOf` refuses.
+             */
+            if (!isEnvelope(member) && isPublishedSplit(program, member, at))
+                return WITHHELD;
+            if (!isEnvelope(member) && held.refusedAt(member, at))
+                return WITHHELD;
+            const shape = withVisibility(at, () => isEnvelope(member)
+                ? shapeOfEnvelope(program, member)
+                : shapeOfModel(program, member, part.keywords));
+            if (shape === undefined)
+                return NOTHING;
+            shapes.push(shape);
+        }
+        return mergeShapes(program, shapes);
+    }
+    finally {
+        mergesInFlight.pop();
+    }
+}
+function mergeShapes(program, shapes) {
+    const keys = [...new Set(shapes.flatMap((shape) => shape.members.map((member) => member.key)))];
     /**
-     * **A deferred property forces the CONSTRUCTOR form of the object.**
-     *
-     * Measured on Zod 4.4.3: `.strict()`, `.loose()` and `.catchall()` all read `shape` eagerly, so
-     * each one fires the getter during module initialisation and throws `Cannot access 'X' before
-     * initialization` - the very thing the getter exists to avoid. `z.strictObject` and
-     * `z.looseObject` take the same shape without reading it.
+     * Each declaration at the visibility its shape is published at - see `positionOfDeclarations` -
+     * wherever that is not where the merge is rendered: `M13[]` beside a named list under a PATCH holds
+     * its element at `Item`, where `M13` is canonical, and its `a: M14` rendered at the PATCH was
+     * `M14Update`, `d` optional where the document's `M14` requires it.
+     */
+    const apart = shapes.some((shape) => shape.at !== visibility);
+    const members = [];
+    for (const key of keys) {
+        const present = [];
+        const declaredAt = [];
+        const beside = [];
+        let forbidden = false;
+        for (const shape of shapes) {
+            const member = shape.members.find((each) => each.key === key);
+            if (member !== undefined) {
+                present.push(member);
+                declaredAt.push(...member.declarations.map(() => shape.at));
+            }
+            else if (shape.sealed)
+                forbidden = true;
+            else if (shape.rest !== undefined) {
+                beside.push({ ...partOfType(program, shape.rest, []), at: shape.at });
+            }
+        }
+        const required = present.some((member) => member.required);
+        // A key a sealed side does not declare: refused when sent, and so no value where it is required.
+        if (forbidden) {
+            if (required)
+                return NOTHING;
+            continue;
+        }
+        const declarations = present.flatMap((member) => member.declarations);
+        const stated = present.flatMap((member) => member.beside);
+        const injected = present.some((member) => member.injected);
+        const [own, ...ancestors] = declarations;
+        if (own === undefined) {
+            members.push({
+                key,
+                property: undefined,
+                position: { ...OWN_POSITION, required, value: mergeParts(program, [...stated, ...beside]) },
+            });
+            continue;
+        }
+        members.push({
+            key,
+            property: own,
+            position: positionOfDeclarations(program, own, ancestors, {
+                required,
+                injected,
+                beside: [...stated, ...beside],
+                ...(apart ? { at: declaredAt } : {}),
+            }),
+        });
+    }
+    return {
+        kind: "object",
+        members,
+        rest: mergedRest(program, shapes),
+        dictionary: shapes.every((shape) => shape.dictionary),
+        keywords: shapes.flatMap((shape) => shape.keywords),
+        site: shapes.length === 1 ? shapes[0]?.site : undefined,
+    };
+}
+/** What a key no member names may hold, across every shape merged. */
+function mergedRest(program, shapes) {
+    if (shapes.some((shape) => shape.sealed))
+        return "sealed";
+    const typed = shapes.filter((shape) => shape.rest !== undefined);
+    if (typed.length === 0)
+        return "open";
+    // `...Record<unknown>` keeps what it is sent; a typed indexer, or a typeless scalar, is a schema.
+    if (typed.every((shape) => isUnknownType(shape.rest)))
+        return "loose";
+    return mergeParts(program, typed.map((shape) => ({ ...partOfType(program, shape.rest, []), at: shape.at })));
+}
+/**
+ * **Whether a merged value refuses anything a declaration states**, at any depth: a refused merge, a
+ * key whose declarations cannot be merged, or a refused declaration it holds. Such a value is not
+ * what the document publishes, so a `@oneOf` cannot count a value against it as the document does.
+ */
+function holdsRefusal(value) {
+    switch (value.kind) {
+        case "never":
+            return value.withheld === true;
+        case "refused":
+            return true;
+        case "object":
+            return value.members.some((member) => member.position.refused !== undefined ||
+                (member.position.value !== undefined && holdsRefusal(member.position.value)));
+        case "nullable":
+            return holdsRefusal(value.inner);
+        case "array":
+            return holdsRefusal(value.element);
+        case "union":
+            return value.members.some(holdsRefusal);
+        case "all":
+            return value.parts.some(holdsRefusal);
+        default:
+            return false;
+    }
+}
+/**
+ * **The refusal a value holds, as the value's own**: the first merge it refuses, at any depth, so the
+ * declaration holding the value reports why - `LeafB.u`, where `D6` meets `@oneOf { M3, M5 }` and
+ * a tuple meets a list. A refused declaration it holds has reported itself, and leaves no value.
+ */
+function heldRefusalOf(value) {
+    switch (value.kind) {
+        case "refused":
+            return value;
+        case "object":
+            for (const member of value.members) {
+                const refused = member.position.refused;
+                if (refused !== undefined) {
+                    return {
+                        kind: "refused",
+                        why: refused.why,
+                        ...(refused.recursive ? { recursive: true } : {}),
+                    };
+                }
+                const inner = member.position.value;
+                if (inner !== undefined && holdsRefusal(inner))
+                    return heldRefusalOf(inner);
+            }
+            return WITHHELD;
+        case "nullable":
+            return heldRefusalOf(value.inner);
+        case "array":
+            return heldRefusalOf(value.element);
+        case "union": {
+            const held = value.members.find(holdsRefusal);
+            return held === undefined ? WITHHELD : heldRefusalOf(held);
+        }
+        case "all": {
+            const held = value.parts.find(holdsRefusal);
+            return held === undefined ? WITHHELD : heldRefusalOf(held);
+        }
+        default:
+            return WITHHELD;
+    }
+}
+/**
+ * The first refusal a merged value holds outside an object's declared members, which report their
+ * own. A member no declaration states - an envelope's `value` - has no one to report it, so its
+ * refusal is the enclosing value's; left there, a recursive merge through an envelope was emitted as
+ * `z.never()` with nothing said.
+ */
+function refusalIn(value) {
+    switch (value.kind) {
+        case "object":
+            return value.members
+                .filter((member) => member.property === undefined)
+                .map((member) => member.position.value === undefined ? undefined : refusalIn(member.position.value))
+                .find((refusal) => refusal !== undefined);
+        case "refused":
+            return value;
+        case "nullable":
+            return refusalIn(value.inner);
+        case "array":
+            return refusalIn(value.element);
+        case "union":
+            return value.members.map(refusalIn).find((why) => why !== undefined);
+        case "all":
+            return value.parts.map(refusalIn).find((why) => why !== undefined);
+        default:
+            return undefined;
+    }
+}
+/** The indexer in force, which a model can inherit - `model X extends Record<unknown>`. */
+export function effectiveIndexer(model) {
+    for (let link = model; link !== undefined; link = link.baseModel) {
+        if (link.indexer !== undefined)
+            return link.indexer;
+    }
+    return undefined;
+}
+/**
+ * The subtypes a `@discriminator` base dispatches to: the models its document's `mapping` names.
+ *
+ * **The compiler's own reading, which is what openapi3 writes the mapping from.** A derived model
+ * that declares no value for the discriminator is looked through to the models derived from it
+ * that do. This used to be the base's DIRECT subtypes, so `Animal` -> `Mammal` (no `kind`) -> `Cat`
+ * dispatched to `Mammal`, which carries no literal `kind`, and Zod threw "Invalid discriminated union
+ * option" on every parse - a known kind, an unknown one, anything - while `Cat`, the model the
+ * mapping names for `"cat"`, was not in the dispatch at all.
+ *
+ * Filtered by openapi3's own {@link includeDerivedModel} so a template declaration is not mistaken
+ * for a real subtype - the same rule that decides whether a base may be sealed.
+ */
+export function discriminatedSubtypes(program, model) {
+    const discriminator = getDiscriminator(program, model);
+    if (discriminator === undefined)
+        return [];
+    return mappedSubtypes(program, model).filter((derived) => extendsModel(derived, model) &&
+        invalidSubtypeOf(program, derived, discriminator.propertyName) === undefined &&
+        // Refused as `split-visibility`, it is `z.never()`, which no dispatch can hold.
+        !isPublishedSplit(program, derived, renderedVisibilityOf(program, derived, visibility)));
+}
+/**
+ * **Whether a subtype is published as `allOf` the base at all.** `Create<Pet>` is a model of its
+ * own, its mapping the canonical `Cat`'s, which holds `x` to `B` where `CreatePet` holds it to
+ * `CreateB`: the document validates a value by `CreatePet`'s own properties, and dispatched to `Cat`
+ * it accepted the `B` that `CreatePet` refuses.
+ */
+function extendsModel(derived, model) {
+    for (let link = derived.baseModel; link !== undefined; link = link.baseModel) {
+        if (link === model)
+            return true;
+    }
+    return false;
+}
+/**
+ * The subtypes a discriminated base dispatches to, each with the discriminator value its mapping
+ * names it for - see {@link discriminatedSubtypes}.
+ */
+export function dispatchedSubtypesOf(program, model) {
+    const discriminator = getDiscriminator(program, model);
+    if (discriminator === undefined)
+        return [];
+    const held = new Set(discriminatedSubtypes(program, model));
+    const { variants } = ignoreDiagnostics(getDiscriminatedUnionFromInheritance(model, discriminator));
+    return [...variants].filter(([, derived]) => held.has(derived));
+}
+/** Every model the base's `mapping` names, whether or not a dispatch can hold it. */
+function mappedSubtypes(program, model) {
+    const discriminator = getDiscriminator(program, model);
+    if (discriminator === undefined)
+        return [];
+    const { variants } = ignoreDiagnostics(getDiscriminatedUnionFromInheritance(model, discriminator));
+    return [...new Set(variants.values())].filter((derived) => includeDerivedModel(derived));
+}
+/**
+ * **Why a model the mapping names cannot be dispatched to, or `undefined` where it can.**
+ *
+ * A dispatch reads one fixed value per subtype - `z.discriminatedUnion` has no other way to choose -
+ * and the document's `mapping` names a subtype for exactly the values its discriminator fixes. Two
+ * declarations break that, and each used to break the emitted module:
+ *
+ * - **a discriminator that is not one fixed value** - `kind: "lab" | string`, or a subtype that
+ *   renames `kind` with `@encodedName` so the `kind` it publishes is its base's open `string`. Zod
+ *   threw "Invalid discriminated union option" on the first parse, or on import.
+ * - **a value a declaration above it refuses** - `kind: "cobra"` under `@maxLength(3) kind: string`.
+ *   The document publishes the subtype as `allOf` that base, so no value is one; validated as its own
+ *   declaration alone, every `"cobra"` was accepted.
+ *
+ * Each is refused as `invalid-subtype-discriminator`, as `undeclared-discriminator` refuses a
+ * discriminator the document cannot state, and the base dispatches to its other subtypes.
+ */
+export function invalidSubtypeOf(program, subtype, propertyName) {
+    const entry = publishedPropertiesOf(program, subtype).find(({ property }) => rawPropertyKey(program, property) === propertyName);
+    const values = entry === undefined ? undefined : fixedValuesOf(entry.property.type);
+    /**
+     * **Fixed, but not where openapi3 reads it**: `Cat { @visibility(Lifecycle.Read) kind: "cat" }`
+     * first reached from a create body is published without its `kind`, which `Pet`'s `string` holds
+     * in its place - see `atPublication`. Told "it publishes 'kind' as 'string'", the author was not
+     * told why their `"cat"` was not it.
+     */
+    const hidden = values !== undefined
+        ? undefined
+        : flattenedPropertiesOf(program, subtype)
+            .filter(({ property }) => rawPropertyKey(program, property) === propertyName)
+            .flatMap(({ property, overridden }) => [property, ...overridden])
+            .find((declaration) => fixedValuesOf(declaration.type) !== undefined &&
+            !atPublication(program, declaration, () => isPayloadProperty(program, declaration)));
+    if (hidden !== undefined) {
+        const at = atPublication(program, hidden, () => visibility);
+        const instead = entry === undefined
+            ? "the 'string' openapi3 adds"
+            : `'${entry.property.model?.name ?? "its base"}''s '${getTypeName(entry.property.type)}'`;
+        return {
+            why: `its '${propertyName}' is not visible at '${visibilityName(at)}', where openapi3 reads the properties of '${hidden.model?.name ?? subtype.name}', so it publishes ${instead} in its place, which is not one fixed value`,
+            satisfiable: true,
+            invisibleAt: at,
+        };
+    }
+    /**
+     * **Declared, but not where the request is**: `@visibility(Lifecycle.Read) kind: "dog"` is no
+     * part of the schema at `Create`, which publishes the `string` openapi3 adds in its place. Told as
+     * "declare it as one fixed value", the author was sent to the declaration already there.
+     */
+    if (entry === undefined && declaresKey(program, subtype, propertyName)) {
+        return {
+            why: `its '${propertyName}' is not visible at '${visibilityName(visibility)}', where it publishes the 'string' openapi3 adds in its place, which is not one fixed value`,
+            satisfiable: true,
+            invisibleAt: visibility,
+        };
+    }
+    if (entry === undefined || values === undefined) {
+        // Renamed away, the key it publishes is the `string` openapi3 adds where no model declares it.
+        const declared = entry !== undefined
+            ? `'${getTypeName(entry.property.type)}'`
+            : injectedDiscriminatorsOf(program, subtype).includes(propertyName)
+                ? "the 'string' openapi3 adds where no model above declares it"
+                : "nothing";
+        return {
+            why: `it publishes '${propertyName}' as ${declared}, which is not one fixed value`,
+            satisfiable: true,
+        };
+    }
+    for (const ancestor of entry.overridden) {
+        const owner = ancestor.model?.name ?? "its base";
+        const published = publishedJsonTypeOf(program, ancestor);
+        if (published !== undefined && published !== "string") {
+            return {
+                why: `it fixes '${propertyName}' as a string, which '${owner}' publishes as a JSON ${published}, so no value is one`,
+                satisfiable: false,
+            };
+        }
+        for (const value of values) {
+            const broken = brokenConstraintOf(program, ancestor, value) ??
+                refusedValueOf(program, ancestor.type, value);
+            if (broken !== undefined) {
+                return {
+                    why: `it fixes '${propertyName}' as '${value}', which '${owner}' refuses with ${broken}, so no value is one`,
+                    satisfiable: false,
+                };
+            }
+        }
+    }
+    return undefined;
+}
+/** Whether a model or one above it declares a key, visible or not. */
+function declaresKey(program, model, key) {
+    for (let link = model; link !== undefined; link = link.baseModel) {
+        for (const property of link.properties.values()) {
+            if (rawPropertyKey(program, property) === key)
+                return true;
+        }
+    }
+    return false;
+}
+/** A visibility as its flags read: `Update | Patch`, `Create | Item`. */
+export function visibilityName(at) {
+    const flags = [
+        ["Read", Visibility.Read],
+        ["Create", Visibility.Create],
+        ["Update", Visibility.Update],
+        ["Delete", Visibility.Delete],
+        ["Query", Visibility.Query],
+        ["Patch", Visibility.Patch],
+        ["Item", Visibility.Item],
+    ];
+    return flags
+        .filter(([, flag]) => (at & flag) !== 0)
+        .map(([named]) => named)
+        .join(" | ");
+}
+/**
+ * Why a declared type refuses a string value, read without running anything - or `undefined` where
+ * it admits it. A union admits what any member admits, so `kind: K2 | null`, with `K2` a scalar whose
+ * base declares `@maxLength(3)`, refuses `"cobra"` through `K2`'s chain.
+ */
+function refusedValueOf(program, type, value) {
+    switch (type.kind) {
+        case "Scalar": {
+            const json = jsonTypeOfScalar(program, type);
+            if (json !== undefined && json !== "string")
+                return `its type, a JSON ${json}`;
+            return brokenConstraintOf(program, type, value);
+        }
+        case "String":
+            return type.value === value ? undefined : `its value '${type.value}'`;
+        case "EnumMember":
+            return (type.value ?? type.name) === value ? undefined : `its value`;
+        case "Enum":
+        case "Union": {
+            const reasons = membersOf(type).map((member) => refusedValueOf(program, member, value));
+            return reasons.includes(undefined) ? undefined : `'${getTypeName(type)}'`;
+        }
+        case "Intrinsic":
+            return type.name === "unknown" ? undefined : `'${type.name}'`;
+        case "Model":
+        case "Tuple":
+        case "Number":
+        case "Boolean":
+            return `'${getTypeName(type)}'`;
+        default:
+            return undefined;
+    }
+}
+/**
+ * **Whether a model is a subtype its base's mapping names that no value can be** - its fixed
+ * discriminator refused by a declaration above it. Refused as `invalid-subtype-discriminator` and
+ * emitted as nothing, so used directly as a body it accepts nothing, as the document does, where it
+ * used to accept its own declaration.
+ */
+export function unsatisfiableSubtype(program, model) {
+    for (let base = model.baseModel; base !== undefined; base = base.baseModel) {
+        const discriminator = getDiscriminator(program, base);
+        if (discriminator === undefined || !mappedSubtypes(program, base).includes(model))
+            continue;
+        if (invalidSubtypeOf(program, model, discriminator.propertyName)?.satisfiable === false) {
+            return true;
+        }
+    }
+    return false;
+}
+/** The JSON type a scalar-valued property is published as, `@encode` included. */
+function publishedJsonTypeOf(program, property) {
+    const encoding = encodedValueOf(program, property);
+    if (encoding.kind === "replaced" || encoding.kind === "both") {
+        return jsonTypeOfScalar(program, encoding.scalar);
+    }
+    const type = nullableInnerOf(property.type) ?? property.type;
+    return type.kind === "Scalar" ? jsonTypeOfScalar(program, type) : undefined;
+}
+/** The fixed string values a discriminator's type allows, or `undefined` where it is open. */
+function fixedValuesOf(type) {
+    switch (type.kind) {
+        case "String":
+            return [type.value];
+        case "EnumMember":
+            return typeof type.value === "number" ? undefined : [type.value ?? type.name];
+        case "UnionVariant":
+            return fixedValuesOf(type.type);
+        case "Enum":
+        case "Union": {
+            const values = [];
+            for (const member of membersOf(type)) {
+                const fixed = fixedValuesOf(member);
+                if (fixed === undefined)
+                    return undefined;
+                values.push(...fixed);
+            }
+            return values;
+        }
+        default:
+            return undefined;
+    }
+}
+/** `invalid-subtype-discriminator` for every model a base's mapping names that cannot be dispatched to. */
+function reportInvalidSubtypes(program, model) {
+    const discriminator = getDiscriminator(program, model);
+    if (discriminator === undefined)
+        return;
+    for (const subtype of mappedSubtypes(program, model)) {
+        const invalid = invalidSubtypeOf(program, subtype, discriminator.propertyName);
+        if (invalid === undefined ||
+            !firstReportOf(program, "invalid-subtype-discriminator", subtype)) {
+            continue;
+        }
+        reportDiagnostic(program, {
+            code: "invalid-subtype-discriminator",
+            messageId: invalid.invisibleAt === undefined ? "default" : "invisible",
+            target: subtype,
+            format: {
+                name: subtype.name,
+                base: model.name,
+                property: discriminator.propertyName,
+                why: invalid.why,
+                at: visibilityName(invalid.invisibleAt ?? visibility),
+            },
+        });
+    }
+}
+/**
+ * **A model extending a base that openapi3 seals because it does not count the model as derived.**
+ *
+ * openapi3 seals a model with no derived models it publishes, and a template instance is not one
+ * (`includeDerivedModel`). So with `seal-object-schemas` on, `Pet<string> extends Animal` leaves
+ * `Animal` sealed, and `Pet<string>` - published as `allOf` that sealed `Animal` - refuses every
+ * value carrying a property `Pet<string>` adds, since `Animal`'s own `unevaluatedProperties` cannot
+ * see it. Validated as its own flattened properties, such a value was accepted. Returns the sealed
+ * base and the keys it refuses, or `undefined` where nothing is refused.
+ */
+export function sealedBaseExtensionOf(program, model) {
+    if (includeDerivedModel(model))
+        return undefined;
+    for (let base = model.baseModel; base !== undefined; base = base.baseModel) {
+        if (!isSealed(base))
+            continue;
+        const sealed = new Set(publishedPropertiesOf(program, base).map(({ property }) => rawPropertyKey(program, property)));
+        const added = publishedPropertiesOf(program, model)
+            .map(({ property }) => property)
+            .filter((property) => !sealed.has(rawPropertyKey(program, property)));
+        if (added.length === 0)
+            return undefined;
+        return {
+            base,
+            keys: added.map((property) => rawPropertyKey(program, property)),
+            // Only a REQUIRED addition leaves no value; an optional one the document refuses only when sent.
+            required: added.some((property) => !(property.optional || isOptionalAt(program, property))),
+        };
+    }
+    return undefined;
+}
+export function discriminatedBaseOf(program, model) {
+    const discriminator = getDiscriminator(program, model);
+    const subtypes = discriminatedSubtypes(program, model);
+    if (discriminator === undefined || subtypes.length === 0)
+        return undefined;
+    const beside = subtypes.filter((subtype) => discriminatedBaseOf(program, subtype) !== undefined);
+    return {
+        propertyName: discriminator.propertyName,
+        dispatched: subtypes.filter((subtype) => !beside.includes(subtype)),
+        beside,
+    };
+}
+const NOTHING_HELD = {
+    refused: () => false,
+    annotated: () => false,
+    refusedAt: () => false,
+    holdsRefusalAt: () => false,
+};
+let held = NOTHING_HELD;
+export function withHeldDeclarations(given, run) {
+    const previous = held;
+    held = given;
+    try {
+        return run();
+    }
+    finally {
+        held = previous;
+    }
+}
+function modelToZod(program, model) {
+    /**
+     * **A `@discriminator` base is its own object, deserialized as a subtype where the value is one.**
+     * See {@link DiscriminatedBase}.
      *
-     * **So the constructor form is used wherever it exists, not only where a cycle forces it.** It is
-     * also what Zod 4 asks for: its own types say "Consider `z.looseObject(A.shape)` instead" on
-     * `.loose()` and `.strict()`, and `.passthrough()` is deprecated outright. Emitting one spelling
-     * means a model that gains a back edge later does not silently change form, and the eager-`shape`
-     * hazard above stops being something this walk has to keep reasoning about.
+     * `z.discriminatedUnion` is the dispatch, and composes both ways this corpus needs. Measured on
+     * Zod 4.4.3: a union may be an OPTION of another union, and an option carrying a getter that refers
+     * back to the union being defined does **not** throw, because the discriminator is read without
+     * enumerating the rest of the shape. `Eagle.friends?: Bird[]` is exactly that. A nested base is a
+     * `z.union` itself, with no literal values to dispatch on, so it sits beside the dispatch.
      *
-     * **A TYPED catchall has no constructor form, and that used to be a refusal.** There is nowhere
-     * safe to put the getter - `.catchall()` reads `shape` eagerly - so the cycle was reported as
-     * `circular-model`. `z.lazy()` is the place to put it: wrapping the whole expression defers the
-     * getter past module initialisation, and by the time the schema is forced every declaration exists.
-     * Measured on 4.4.3: `z.lazy(() => z.object({ get kid() {...} }).catchall(z.number()))` parses a
-     * nested value and still applies the catchall.
+     * The base arm comes last: `z.union` hands back the first arm that accepts, so a valid subtype is
+     * deserialized as that subtype, and only a value no subtype accepts is the base.
      */
-    const lazily = members.some((member) => member.deferred);
-    const constructible = suffix === "" || suffix === ".loose()";
-    const shape = entries.length === 0 ? "{}" : `{\n${entries.join("\n")}\n}`;
-    const body = constructible
-        ? `${suffix === ".loose()" ? "z.looseObject" : strict === ".strict()" ? "z.strictObject" : "z.object"}(${shape})`
-        : lazily
-            ? `z.lazy(() => z.object(${shape})${suffix}${strict})`
-            : `z.object(${shape})${suffix}${strict}`;
-    return applyConstraints(program, body, model);
+    reportInvalidSubtypes(program, model);
+    const base = discriminatedBaseOf(program, model);
+    if (base !== undefined) {
+        const arms = [];
+        const options = base.dispatched
+            .map((derived) => typeToZod(program, derived))
+            .filter((option) => !held.refused(option));
+        const dispatched = options.filter((option) => !held.annotated(option));
+        if (dispatched.length > 0) {
+            arms.push(`z.discriminatedUnion(${literal(base.propertyName)}, [${dispatched.join(", ")}])`);
+        }
+        arms.push(...options.filter((option) => held.annotated(option)));
+        arms.push(...base.beside.map((derived) => typeToZod(program, derived)));
+        arms.push(modelObjectToZod(program, model));
+        return `z.union([${arms.join(", ")}])`;
+    }
+    return modelObjectToZod(program, model);
+}
+/**
+ * A model as the object of its own properties, inherited ones included.
+ *
+ * **Given a discriminated base, this is its base arm**: the same object, with the required `string`
+ * openapi3 adds to the base's properties where the base declares no discriminator of its own.
+ */
+function modelObjectToZod(program, model) {
+    // Refused as `invalid-subtype-discriminator`, by the base whose mapping names it.
+    if (unsatisfiableSubtype(program, model))
+        return UNREPRESENTABLE;
+    if (reportSealedBaseExtended(program, model))
+        return UNREPRESENTABLE;
+    const indexer = effectiveIndexer(model);
+    if (indexer?.key.name === "integer") {
+        const element = atItem(program, model, () => typeToZod(program, indexer.value));
+        return applyConstraints(program, `z.array(${element})`, model);
+    }
+    return mergedToZod(program, objectOfModel(program, model));
+}
+/** `sealed-base-extended` for a model a sealed base leaves no value of, and whether it was one. */
+function reportSealedBaseExtended(program, model) {
+    const extension = sealedBaseExtensionOf(program, model);
+    if (extension?.required !== true)
+        return false;
+    const name = getTypeName(model, { namespaceFilter: () => false });
+    // Keyed on the instance as well: `Twice<string>` and `Twice<int32>` are one node, two findings.
+    if (firstReportOf(program, "sealed-base-extended", model, name)) {
+        reportDiagnostic(program, {
+            code: "sealed-base-extended",
+            target: model,
+            format: {
+                name,
+                base: getTypeName(extension.base, { namespaceFilter: () => false }),
+                keys: extension.keys.map((key) => `'${key}'`).join(", "),
+            },
+        });
+    }
+    return true;
 }
 /**
- * **What JSON kind a value of this type arrives as, for a parameter carried in text.**
+ * A model as the object it publishes at the current position: the merge of one - see
+ * {@link mergeShapes}. **HTTP metadata is not payload**, and neither is a property invisible here or
+ * a `never` one, which the document drops; each is judged declaration by declaration - see
+ * {@link publishedPropertiesOf}.
+ */
+export function objectOfModel(program, model) {
+    const shape = shapeOfModel(program, model, []);
+    return shape === undefined ? NOTHING : mergeShapes(program, [shape]);
+}
+/**
+ * **Whether a value of this type can be anything but text, so a parameter carried in text needs
+ * reading** - see `wireRead`, which reads it against the schema. A type all of whose values are
+ * strings is left without a reader, and its validator is the schema alone.
  *
  * A path, query or header value is always a string on the wire, so a numeric or boolean parameter has
- * to be decoded before the document's schema runs. Deciding WHICH decoder applies used to be done by
+ * to be decoded before the document's schema runs. Deciding WHETHER it is used to be done by
  * inspecting the emitted Zod - `declared.startsWith("z.number()")` - which is a string about a string
  * and fails silently the moment the expression is spelled any other way.
  *
@@ -928,9 +3088,12 @@ function modelToZod(program, model) {
  * is a number - the disagreement is with the wire.
  *
  * Reading the TYPE answers the question the emitted text was standing in for. `SCALARS` remains the
- * single list of what becomes a number.
+ * single list of what becomes a number. **And WHICH reading is the value's is the schema's to say**,
+ * not a kind read from the type: a kind could not say `int32 | boolean`, a numeric enum, or
+ * `int32 | "all"`, and each refused a value the document accepts.
  *
- * **It still inspects the emitted expression to decide WHICH kind, and that did drift once more.**
+ * **It still inspects the emitted expression to decide whether a scalar is numeric, and that did
+ * drift once more.**
  * The test was `startsWith("z.number()")`, and giving each integer width its declared bounds spelled
  * nine of them `z.int(`, `z.int32(` and `z.uint32(` instead. Every one silently lost its wire
  * decoder: 22 arms went red at once, which is the only reason it was not shipped. The prefixes live
@@ -947,41 +3110,49 @@ function modelToZod(program, model) {
  * have to agree and nothing about the two being in the same file makes them.
  */
 const NUMERIC_EXPRESSIONS = ["z.number()", "z.int(", "z.int32(", "z.uint32("];
-export function wireKindOf(program, type) {
-    if (type.kind === "Scalar") {
-        const encoded = encodedTypeOf(program, type);
-        if (encoded !== undefined && encoded !== type)
-            return wireKindOf(program, encoded);
-        for (let current = type; current !== undefined; current = current.baseScalar) {
-            const mapped = SCALARS[current.name];
-            if (mapped === undefined)
-                continue;
-            if (NUMERIC_EXPRESSIONS.some((prefix) => mapped.startsWith(prefix)))
-                return "number";
-            if (mapped === "z.boolean()")
-                return "boolean";
-            return undefined;
-        }
-        return undefined;
-    }
-    // A literal is its own type, and a union of them is the enum form a parameter commonly takes.
-    if (type.kind === "Number")
-        return "number";
-    if (type.kind === "Boolean")
-        return "boolean";
-    if (type.kind === "Union") {
-        const kinds = new Set();
-        for (const variant of type.variants.values()) {
-            // `T | null` is still a T on the wire; the null arm needs no decoding.
-            if (variant.type.kind === "Intrinsic" && variant.type.name === "null")
-                continue;
-            kinds.add(wireKindOf(program, variant.type));
+export function readsFromText(program, type) {
+    switch (type.kind) {
+        case "Scalar": {
+            // Its own encoding or an inherited one - see `scalarEncodingOf`.
+            const encoded = scalarEncodingOf(program, type)?.encoded;
+            // A scalar that is not standard states no type, and the schema walk refuses it.
+            if (encoded !== undefined && !program.checker.isStdType(encoded))
+                return false;
+            if (encoded !== undefined)
+                return readsFromText(program, encoded);
+            for (let current = type; current !== undefined; current = current.baseScalar) {
+                const mapped = standardScalarSchemaOf(program, current);
+                if (mapped === undefined)
+                    continue;
+                return (NUMERIC_EXPRESSIONS.some((prefix) => mapped.startsWith(prefix)) ||
+                    mapped === "z.boolean()");
+            }
+            // A scalar with no standard base is any value, which text can spell as a number.
+            return isTypelessMember(program, type);
         }
-        if (kinds.size !== 1)
-            return undefined;
-        return [...kinds][0];
+        /**
+         * **A value of any type is read from text as one too**: `@maxLength(2) a?: string | unknown`
+         * sent `?a=12345` is the number the document reads, which no `maxLength` constrains. Left as
+         * text, it was refused as too long.
+         */
+        case "Intrinsic":
+            return type.name === "unknown";
+        // A literal is its own type, and a union of them is the enum form a parameter commonly takes.
+        case "Number":
+        case "Boolean":
+            return true;
+        case "EnumMember":
+            return typeof type.value === "number";
+        case "Enum":
+            return [...type.members.values()].some((member) => typeof member.value === "number");
+        case "UnionVariant":
+            return readsFromText(program, type.type);
+        // Any member that is not text: `int32 | boolean`, `int32 | "all"` - see `wireRead`.
+        case "Union":
+            return [...type.variants.values()].some((variant) => readsFromText(program, variant.type));
+        default:
+            return false;
     }
-    return undefined;
 }
 /**
  * A name as an object key - quoted when it is not a legal JavaScript identifier.
@@ -1065,11 +3236,7 @@ export function jsDocComment(text, indent) {
  * validator that renamed on the way through would be a transform, which JSON Schema cannot express
  * and no document could state - the same reason `@trimmed` was removed.
  */
-function propertyKey(program, property) {
-    return objectKey(rawPropertyKey(program, property));
-}
-/** The same wire name, unquoted - for a vocabulary tuple, where the value is data rather than code. */
-function rawPropertyKey(program, property) {
+export function rawPropertyKey(program, property) {
     return resolveEncodedName(program, property, JSON_MEDIA_TYPE);
 }
 /**
@@ -1149,37 +3316,963 @@ function isStdDateTime(program, scalar) {
 }
 /** Whether a property's value, or a scalar, is a date-time: one of the two, or built on one. */
 function isDateTime(program, target) {
-    const type = target.kind === "ModelProperty" ? (nullableInnerOf(target.type) ?? target.type) : target;
+    const type = target.kind === "ModelProperty" ? encodingTargetOf(target.type) : target;
     for (let current = type.kind === "Scalar" ? type : undefined; current !== undefined; current = current.baseScalar) {
         if (isStdDateTime(program, current))
             return true;
     }
-    return false;
-}
-export function encodedTypeOf(program, target) {
-    const encoded = getEncode(program, target);
-    if (encoded === undefined) {
-        return target.kind === "ModelProperty" && isDateTimeHeader(program, target)
-            ? program.checker.getStdType("string")
-            : undefined;
+    return false;
+}
+/**
+ * The type a property's `@encode` lands on in the document: the one member beside `null` where
+ * openapi3 applies it there, and the declared type otherwise - see `encodedBesideNullOf`. A named
+ * `union MaybeTime { utcDateTime, null }` is a `$ref`, so `rfc3339` on it publishes `type: string`
+ * over the whole union and refuses `null`; read through the `null`, it was "no change", and `null`
+ * was accepted.
+ */
+function encodingTargetOf(type) {
+    const beside = encodedBesideNullOf(type);
+    return beside?.length === 1 && beside[0] !== undefined ? beside[0] : type;
+}
+/** Whether a property's value, or a scalar, is a `duration`, or built on one. */
+function isDuration(program, target) {
+    const type = target.kind === "ModelProperty" ? encodingTargetOf(target.type) : target;
+    for (let current = type.kind === "Scalar" ? type : undefined; current !== undefined; current = current.baseScalar) {
+        if (current === program.checker.getStdType("duration"))
+            return true;
+    }
+    return false;
+}
+/**
+ * The JSON type a value is published as before its own `@encode` replaces it: a property's declared
+ * scalar, or the base a scalar is built from. `undefined` where it is not a scalar.
+ */
+function typeBeforeEncoding(program, target) {
+    const type = target.kind === "ModelProperty" ? encodingTargetOf(target.type) : target.baseScalar;
+    return type?.kind === "Scalar" ? jsonTypeOfScalar(program, type) : undefined;
+}
+export function encodedTypeOf(program, target) {
+    const encoded = getEncode(program, target);
+    if (encoded === undefined) {
+        return target.kind === "ModelProperty" && isDateTimeHeader(program, target)
+            ? program.checker.getStdType("string")
+            : undefined;
+    }
+    /**
+     * **`rfc3339` on a date-time is the form it already has, so it changes nothing.** openapi3's
+     * `mergeFormatAndEncoding` keeps `format: date-time` for it, and the type it reports, `string`,
+     * emitted `z.string()`: the explicit spelling of the default dropped the date-time check the
+     * document still states. Only the encodings that change the wire form - `rfc7231`,
+     * `unixTimestamp` - change the type.
+     *
+     * **Only where the value already IS that string.** `@encode(rfc3339) at: Ts`, with `Ts` a
+     * date-time `@encode`d as an integer, publishes `{ $ref: Ts, type: "string" }`, which no value
+     * satisfies; read as "no change" it validated `Ts`'s integer and contradicted the document. The
+     * same holds for `ISO8601` on a duration, the form `duration` already has.
+     */
+    const before = typeBeforeEncoding(program, target);
+    const unchanged = (encoded.encoding === "rfc3339" && isDateTime(program, target)) ||
+        (encoded.encoding === "ISO8601" && isDuration(program, target));
+    if (unchanged && before === "string")
+        return undefined;
+    if (target.kind === "ModelProperty" &&
+        isQueryParam(program, target) &&
+        PARAMETER_STYLE_ENCODINGS.has(encoded.encoding ?? "")) {
+        return undefined;
+    }
+    return encoded.type;
+}
+export function encodedValueOf(program, property) {
+    const scalar = encodedTypeOf(program, property);
+    if (scalar === undefined)
+        return { kind: "declared" };
+    const declared = property.type;
+    if (!program.checker.isStdType(scalar)) {
+        return { kind: "unsatisfiable", scalar, declared, why: "typeless" };
+    }
+    const besideNull = encodedBesideNullOf(declared);
+    const nullable = besideNull !== undefined;
+    const inner = besideNull ?? [declared];
+    const whole = inner.length === 1 ? inner[0] : undefined;
+    if (whole !== undefined && !keepsDeclaredType(program, whole)) {
+        return { kind: "replaced", scalar, nullable };
+    }
+    // A standard scalar always has a JSON type.
+    const target = jsonTypeOfScalar(program, scalar) ?? "string";
+    const members = whole === undefined ? inner : membersOf(whole);
+    const kept = members.filter((member) => admits(program, member, target));
+    if (kept.length === 0) {
+        return { kind: "unsatisfiable", scalar, declared, why: nullable ? "null" : "nothing" };
+    }
+    return {
+        kind: "both",
+        scalar,
+        form: getEncode(program, property)?.encoding,
+        nullable,
+        /**
+         * The declared type whole where nothing was ruled out and it holds no scalar of its own -
+         * so a named enum or union of literals is still referenced - and its members otherwise, so a
+         * member scalar can be read the way `keptMemberToZod` reads it.
+         */
+        kept: whole !== undefined &&
+            kept.length === members.length &&
+            (whole.kind === "Scalar" || !members.some((member) => member.kind === "Scalar"))
+            ? whole
+            : kept,
+        within: kept.every((member) => isWithin(program, member, target)),
+    };
+}
+/**
+ * **The members beside `null` that openapi3 3.1 applies an encoding to, where it applies it to them
+ * rather than to the whole union.**
+ *
+ * Its `applyEncoding` takes that path only for an `anyOf` of exactly two members, one of them
+ * `{ type: "null" }`. The members are what it PUBLISHES, not the variants written: literals of one
+ * kind are merged into a single `enum`, so `"a" | "b" | null` is two members and `null` survives the
+ * encoding, while `"a" | 1 | null` is three and the encoded `type` refuses `null`. A named union is
+ * published as a `$ref`, never as that `anyOf`. Read off the variants, `"a" | "b" | null` refused the
+ * `null` the document allows.
+ */
+function encodedBesideNullOf(type) {
+    if (type.kind !== "Union" || isPublishedAsReference(type))
+        return undefined;
+    const variants = [...type.variants.values()].map((variant) => variant.type);
+    const isNull = (each) => each.kind === "Intrinsic" && each.name === "null";
+    const nulls = variants.filter(isNull).length;
+    if (nulls !== 1)
+        return undefined;
+    const rest = variants.filter((each) => !isNull(each));
+    const isLiteral = (each) => each.kind === "String" || each.kind === "Number" || each.kind === "Boolean";
+    // Each `null` is a member of its own: `"a" | null | null` publishes three, and the encoding lands
+    // on the whole `anyOf`.
+    const published = new Set(rest.filter(isLiteral).map((each) => each.kind)).size +
+        rest.filter((each) => !isLiteral(each)).length;
+    return published === 1 ? rest : undefined;
+}
+/**
+ * **Whether openapi3 publishes a union as a `$ref` to a component, rather than inline.**
+ *
+ * A named union is a component; an anonymous one is written out where it is used. A union template
+ * instance is a component only where every argument has a name of its own to build the component's
+ * name from - `Opt<int32>` is `OptInt32` - and is written out inline otherwise, as `Opt<"a">` is:
+ * the emitter that names declarations calls such an instance "unspeakable". Read as a `$ref`, the
+ * `null` that `Opt<"a">` publishes beside `"a"` was refused.
+ */
+function isPublishedAsReference(union) {
+    if (union.name === undefined || union.name === "")
+        return false;
+    return union.templateMapper === undefined || union.templateMapper.args.every(isSpeakable);
+}
+/** Whether a template argument has a declaration name openapi3 can build a component name from. */
+function isSpeakable(argument) {
+    const type = (argument.entityKind === "Indeterminate"
+        ? argument.type
+        : argument);
+    if (type === undefined || !("kind" in type))
+        return false;
+    switch (type.kind) {
+        case "Model":
+        case "Scalar":
+        case "Interface":
+        case "Operation":
+        case "Enum":
+        case "Union":
+        case "Intrinsic":
+            if (!("name" in type) || type.name === undefined || type.name === "")
+                return false;
+            return (!("templateMapper" in type) ||
+                type.templateMapper === undefined ||
+                type.templateMapper.args.every(isSpeakable));
+        default:
+            return false;
+    }
+}
+/**
+ * Whether openapi3 keeps the declared type's schema beside an encoding in a way that still
+ * constrains the value: a `$ref` to anything it declares - a model, an enum, a named union, a scalar
+ * outside the standard library - or an inline union or literal, whose `anyOf` or `enum` stays.
+ *
+ * **Declared means what `@typespec/openapi` says is declared**, through its own `shouldInline`. An
+ * inline list, record or object - `{ ...Filter }` among them, which has no name of its own - keeps
+ * only keywords a scalar is not checked against. This read the emitter's own naming, which names a
+ * spread after the model spread into it, and refused `{ ...Filter }` as unsatisfiable while the
+ * document publishes it inline and accepts any string.
+ */
+function keepsDeclaredType(program, declared) {
+    switch (declared.kind) {
+        case "Enum":
+        case "EnumMember":
+        case "Union":
+        case "String":
+        case "Number":
+        case "Boolean":
+            return true;
+        case "Scalar":
+        case "Model":
+            return !shouldInline(program, declared);
+        default:
+            return false;
+    }
+}
+/** A declared type as the members its schema lists: a union's variants, an enum's members. */
+/**
+ * **A union's members, a nested union spelled out only where it combines as the union does** -
+ * `anyOf` inside `anyOf`, `oneOf` inside `oneOf`. A nested union of the other kind is one member,
+ * whole: `@oneOf` over `int32 | float` and a `string` is exactly one of two, where spelled out it was
+ * exactly one of three and an integer, both an `int32` and a `float`, was none; and a `@oneOf` inside
+ * a plain union, spelled out, admitted the value two of its members accept.
+ */
+function alikeMembersOf(program, type, exclusive = isExclusive(program, type)) {
+    if (type.kind === "UnionVariant")
+        return alikeMembersOf(program, type.type, exclusive);
+    if (type.kind === "Enum")
+        return [...type.members.values()];
+    if (type.kind !== "Union")
+        return [type];
+    /**
+     * **A nested union is one member unless both sides are `anyOf`**: `anyOf(anyOf(a, b), c)` is
+     * `anyOf(a, b, c)`, but `oneOf(oneOf(a, b), c)` is not `oneOf(a, b, c)` - `1` matches both of
+     * `int32 | float` and so fails the inner union, and is valid by `c` alone. Spelled out, `1` was
+     * refused where the document accepts it.
+     */
+    const members = [...type.variants.values()].flatMap((variant) => {
+        const member = variant.type;
+        return member.kind === "Union" && (exclusive || isPublishedOneOf(program, member))
+            ? [member]
+            : alikeMembersOf(program, member, exclusive);
+    });
+    return exclusive ? withoutRepeatedLiterals(members) : members;
+}
+/**
+ * **A literal repeated in a `@oneOf` is one member**, as openapi3 publishes every literal of one
+ * JSON kind as one `enum`: `@oneOf union D { a: 1, b: 1, c: string }` is
+ * `oneOf: [{ enum: [1, 1] }, { type: string }]`, which `1` matches once. Each its own member, `1`
+ * matched two, and was refused.
+ */
+function withoutRepeatedLiterals(members) {
+    const seen = new Set();
+    return members.filter((member) => {
+        const value = isEnvelope(member) || member.kind === "EnumMember" ? undefined : literalValueOf(member);
+        if (value === undefined)
+            return true;
+        const key = `${typeof value}\u0000${String(value)}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Whether `null` is a value of a type: a member, once under `@oneOf`, or a member with no type. */
+function admitsNullValue(program, type, exclusive = isExclusive(program, type)) {
+    if (type.kind === "UnionVariant")
+        return admitsNullValue(program, type.type);
+    if (isNull(type) || isTypelessMember(program, type))
+        return true;
+    if (type.kind !== "Union")
+        return false;
+    const matches = alikeMembersOf(program, type, exclusive).filter((member) => admitsNullValue(program, member)).length;
+    return exclusive ? matches === 1 : matches > 0;
+}
+function membersOf(type) {
+    // `DogKind.Golden` names a variant of a union, and stands for its type.
+    if (type.kind === "UnionVariant")
+        return membersOf(type.type);
+    if (type.kind === "Union")
+        return [...type.variants.values()].flatMap((v) => membersOf(v.type));
+    if (type.kind === "Enum")
+        return [...type.members.values()];
+    return [type];
+}
+/** Whether a member of the declared type has a value of the encoded scalar's JSON type. */
+function admits(program, member, target) {
+    const types = jsonTypesOf(program, member);
+    if (types === undefined)
+        return true;
+    return [...types].some((type) => type === target ||
+        (target === "integer" && type === "number") ||
+        (target === "number" && (type === "integer" || type === "fraction")));
+}
+/** Whether every value of a member is of the encoded scalar's JSON type, so it alone says both. */
+function isWithin(program, member, target) {
+    const types = jsonTypesOf(program, member);
+    if (types === undefined)
+        return false;
+    return [...types].every((type) => type === target || (target === "number" && (type === "integer" || type === "fraction")));
+}
+const INTEGER_SCALARS = [
+    "integer",
+    "int8",
+    "int16",
+    "int32",
+    "int64",
+    "uint8",
+    "uint16",
+    "uint32",
+    "uint64",
+    "safeint",
+];
+const NUMBER_SCALARS = ["numeric", "float", "float32", "float64", "decimal", "decimal128"];
+/**
+ * The JSON type a scalar is published as, its own scalar-level `@encode` included - or `undefined`
+ * for a scalar with no standard base, which openapi3 publishes as `{}`, any value. Read as a string,
+ * `@encode("x", int32)` on one was refused as unsatisfiable while the document accepts `5`.
+ */
+export function jsonTypeOfScalar(program, scalar) {
+    const { checker } = program;
+    for (let current = scalar; current !== undefined; current = current.baseScalar) {
+        const encoded = encodedTypeOf(program, current);
+        if (encoded !== undefined && encoded !== current && checker.isStdType(encoded)) {
+            return jsonTypeOfScalar(program, encoded);
+        }
+        const link = current;
+        if (INTEGER_SCALARS.some((name) => link === checker.getStdType(name)))
+            return "integer";
+        if (NUMBER_SCALARS.some((name) => link === checker.getStdType(name)))
+            return "number";
+        if (link === checker.getStdType("boolean"))
+            return "boolean";
+        if (checker.isStdType(link))
+            return "string";
+    }
+    return undefined;
+}
+/** The JSON types a declared type admits, or `undefined` where it admits any. */
+function jsonTypesOf(program, type) {
+    const numeric = (value) => (Number.isInteger(value) ? "integer" : "fraction");
+    switch (type.kind) {
+        case "Scalar": {
+            const json = jsonTypeOfScalar(program, type);
+            return json === undefined ? undefined : new Set([json]);
+        }
+        case "String":
+            return new Set(["string"]);
+        case "Number":
+            return new Set([numeric(type.value)]);
+        case "Boolean":
+            return new Set(["boolean"]);
+        case "EnumMember":
+            return new Set([typeof type.value === "number" ? numeric(type.value) : "string"]);
+        case "Enum":
+        case "Union": {
+            const types = new Set();
+            for (const member of membersOf(type)) {
+                const memberTypes = jsonTypesOf(program, member);
+                if (memberTypes === undefined)
+                    return undefined;
+                for (const each of memberTypes)
+                    types.add(each);
+            }
+            return types;
+        }
+        case "Tuple":
+            return new Set(["array"]);
+        case "Model":
+            return new Set([type.indexer?.key.name === "integer" ? "array" : "object"]);
+        case "Intrinsic":
+            return type.name === "null" ? new Set(["null"]) : undefined;
+        default:
+            return undefined;
+    }
+}
+/** `unsatisfiable-encoding`, once per declaration however many positions render it. */
+function reportUnsatisfiableEncoding(program, target, format) {
+    if (!firstReportOf(program, "unsatisfiable-encoding", target, `${format.declared} ${format.encoded}`)) {
+        return;
+    }
+    const why = {
+        typeless: `'${format.encoded}' is not a standard scalar, so '@typespec/openapi3' publishes no type for it and the document accepts any value`,
+        nothing: "'@typespec/openapi3' keeps the declared type beside the encoded one, and no value is both, so the document accepts nothing",
+        null: "'@typespec/openapi3' keeps the declared type beside the encoded one, and no value but null is both, so the document accepts only null",
+    }[format.why];
+    reportDiagnostic(program, {
+        code: "unsatisfiable-encoding",
+        target,
+        format: { name: format.name, declared: format.declared, encoded: format.encoded, why },
+    });
+}
+/** A type's name for a message: its own where it has one, else its spelling. */
+function nameOfType(type) {
+    return "name" in type && typeof type.name === "string" && type.name !== ""
+        ? type.name
+        : getTypeName(type);
+}
+/**
+ * **Whether an encoded value is written as the encoded scalar intersected with what it keeps.**
+ *
+ * Where the kept type alone says both it is written alone - but a constraint on the property cannot
+ * go on a kept union or literal, which carries no `.min` or `.regex`, so then the constraints go on
+ * the encoded scalar and the kept type is intersected beside it. Applied to the union,
+ * `@encode("x", string) @minLength(2) v: string | "a"` emitted `z.union(...).min(2)`, and the module
+ * threw on import.
+ */
+export function encodedIntersects(program, property, encoding) {
+    if (!encoding.within)
+        return true;
+    const kept = encoding.kept;
+    const scalar = !Array.isArray(kept) && kept.kind === "Scalar";
+    return hasConstraints(program, property) && !scalar;
+}
+/**
+ * **A union property's constraints, applied to each member as JSON Schema applies them.**
+ *
+ * `@minLength(2) v: string | "a" | int32` is published `{ anyOf: [...], minLength: 2 }`, and
+ * `minLength` constrains a value only where it is a string: `"ab"` and `5` are valid, `"a"` is not.
+ * Each member takes the keywords of its own JSON type, and a literal member breaking one is no value
+ * at all. Applied to the union, this emitted `z.union(...).min(2)`, and the module threw on import.
+ * The constraints are the property's own and those of every declaration above it the position
+ * leaves - see `PropertyPosition` - and, where openapi3 adds the discriminator as a `string`, only
+ * the members that can be a string are left. Returns the members left, or `undefined` where the
+ * property is not a union read member by member.
+ */
+export function constrainedMembersOf(program, property, position = OWN_POSITION) {
+    const declared = nullableInnerOf(property.type) ?? property.type;
+    const sources = [property, ...position.constrainedBy];
+    const constrained = sources.some((source) => hasConstraints(program, source));
+    const typeless = isTypelessMember(program, declared);
+    /**
+     * A value with no type of its own, constrained or narrowed to a string, is read as its kinds. An
+     * enum a keyword constrains is read as its members, as a union of literals is: `e: Color` under a
+     * declaration's `@maxLength(3)` keeps `red`, where the keyword applied to the enum's schema was
+     * `colorSchema.max(3)`, and the module threw on import.
+     */
+    const members = declared.kind === "Union" || (declared.kind === "Enum" && constrained);
+    if (!members && !(typeless && (position.stringOnly || constrained))) {
+        return undefined;
+    }
+    // A `null` a declaration above refuses is no member.
+    const dropsNull = position.nonNull && hasNull(declared);
+    if (declared.kind === "Union" && !constrained && !position.stringOnly && !dropsNull) {
+        return undefined;
+    }
+    const string = program.checker.getStdType("string");
+    const exclusive = isExclusive(program, declared) || isExclusive(program, property);
+    return (alikeMembersOf(program, declared, exclusive)
+        .flatMap((member) => {
+        if (!position.nonNull)
+            return [member];
+        const kept = withoutNull(program, member);
+        return kept === undefined ? [] : [kept];
+    })
+        .map((member) => (position.stringOnly && isTypelessMember(program, member) ? string : member))
+        .filter((member) => !position.stringOnly || admits(program, member, "string"))
+        /**
+         * A literal a declaration above refuses is no member: by its keywords, or by the check its
+         * declared scalar emits. Each member is then exactly its values the position admits, so a
+         * `@oneOf` counts a value as before: `@oneOf union O1 { Color, string }` under `k: utcDateTime`
+         * kept `"red"`, matched by no other narrowed member, where the document finds it in two.
+         */
+        .filter((member) => {
+        const value = literalValueOf(member);
+        return (value === undefined ||
+            sources.every((source) => brokenConstraintOf(program, source, value) === undefined &&
+                (source.kind !== "Scalar" || scalarAccepts(program, source, value) !== false)));
+    }));
+}
+/**
+ * **A member without its `null`, where a declaration above refuses `null`**, or `undefined` where
+ * nothing is left. A `@oneOf` keeps a nested union whole - see `alikeMembersOf` - so the `null` of
+ * `@oneOf union O8 { v0: "x" | null, v1: "y" }` sat inside a member, and under `c: string` the
+ * value accepted the `null` the document refuses. Taken out of the member it is sound: a value other
+ * than `null` matches each member exactly as before, so a `@oneOf` counts it the same.
+ */
+function withoutNull(program, member) {
+    const type = member.kind === "UnionVariant" ? member.type : member;
+    if (isNull(type))
+        return undefined;
+    if (type.kind !== "Union" || !hasNull(type))
+        return member;
+    const kept = [...type.variants.values()].flatMap((variant) => {
+        const each = withoutNull(program, variant.type);
+        return each === undefined ? [] : [each];
+    });
+    if (kept.length <= 1)
+        return kept[0];
+    const union = $(program).union.create(kept);
+    if (isExclusive(program, type))
+        exclusiveWithoutNull.add(union);
+    return union;
+}
+/** The unions {@link withoutNull} builds from a `@oneOf`, which stay exclusive without the decorator. */
+const exclusiveWithoutNull = new WeakSet();
+/** A member with no JSON type of its own: `unknown`, or a scalar with no standard base. */
+export function isTypelessMember(program, member) {
+    if (member.kind === "Intrinsic")
+        return member.name === "unknown";
+    return member.kind === "Scalar" && jsonTypeOfScalar(program, member) === undefined;
+}
+/**
+ * **Any JSON value, kind by kind** - what a member with no type is, where a keyword constrains the
+ * kinds it applies to: `@minLength(2) v: string | unknown` refuses `"a"`, which `unknown` alone
+ * accepted. TypeScript states the same union.
+ */
+const ANY_JSON = [
+    ["z.string()", "string", "string"],
+    ["z.number()", "number", "number"],
+    ["z.boolean()", "boolean", "boolean"],
+    ["z.null()", "null", "null"],
+    ["z.array(z.unknown())", "array", "unknown[]"],
+    ["z.record(z.string(), z.unknown())", "object", "globalThis.Record<string, unknown>"],
+];
+export const ANY_JSON_TS = ANY_JSON.map(([, , ts]) => ts).join(" | ");
+/**
+ * A value with the constraints of the declarations above it applied - see `PropertyPosition` - for
+ * the value's own JSON type, as JSON Schema applies them through `allOf`.
+ */
+function withAncestors(program, value, property, position) {
+    const json = ownJsonTypeOf(program, property);
+    return position.constrainedBy.reduce((each, ancestor) => applyConstraints(program, each, ancestor, json === undefined ? { quiet: true } : { type: json, quiet: true }), value);
+}
+/** The JSON type of a property's own value, where one keyword family applies to it. */
+function ownJsonTypeOf(program, property) {
+    const published = publishedJsonTypeOf(program, property);
+    if (published !== undefined)
+        return published;
+    const declared = nullableInnerOf(property.type) ?? property.type;
+    if (declared.kind === "Model")
+        return declared.indexer?.key.name === "integer" ? "array" : "object";
+    if (declared.kind === "Tuple")
+        return "array";
+    return isNull(declared) ? "null" : undefined;
+}
+/** `unrepresentable-override`, once per declaration and ancestor. */
+function reportUnrepresentableOverride(program, property, position) {
+    const refused = position.refused;
+    if (refused === undefined)
+        return;
+    const owner = refused.ancestor.model?.name ?? "its base";
+    if (!firstReportOf(program, "unrepresentable-override", property, owner))
+        return;
+    reportDiagnostic(program, {
+        code: "unrepresentable-override",
+        messageId: refused.recursive ? "recursive" : "default",
+        target: property,
+        format: {
+            name: property.name,
+            model: property.model?.name ?? "",
+            base: owner,
+            declared: getTypeName(refused.ancestor.type, { namespaceFilter: () => false }),
+            why: refused.why,
+        },
+    });
+}
+/** A literal member's value, or `undefined` where the member is not a literal. */
+function literalValueOf(type) {
+    switch (type.kind) {
+        case "String":
+        case "Number":
+        case "Boolean":
+            return type.value;
+        case "EnumMember":
+            return type.value ?? type.name;
+        default:
+            return undefined;
+    }
+}
+/** One member of a constrained union, with each source's keywords for its JSON type. */
+function constrainedMemberToZod(program, member, sources) {
+    const constrain = (schema, type) => sources.reduce((value, source) => applyConstraints(program, value, source, { type, quiet: true }), schema);
+    if (isTypelessMember(program, member)) {
+        return `z.union([${ANY_JSON.map(([schema, json]) => constrain(schema, json)).join(", ")}])`;
+    }
+    const schema = typeToZod(program, member);
+    if (literalValueOf(member) !== undefined)
+        return schema;
+    const type = member.kind === "Scalar"
+        ? jsonTypeOfScalar(program, member)
+        : member.kind === "Tuple" ||
+            (member.kind === "Model" && member.indexer?.key.name === "integer")
+            ? "array"
+            : member.kind === "Intrinsic" && member.name === "null"
+                ? "null"
+                : member.kind === "Model"
+                    ? "object"
+                    : undefined;
+    return type === undefined ? schema : constrain(schema, type);
+}
+/**
+ * What an encoded property keeps of its declared type, as Zod: the whole type where none of it was
+ * ruled out, else the members of the encoded scalar's JSON type.
+ *
+ * **A declared scalar of the encoded scalar's JSON type keeps its keywords and not its format.**
+ * openapi3 publishes `@encode(rfc7231) at: Instant` as `{ $ref: Instant, type: "string" }`, and
+ * `Instant`'s own check - an ISO date-time - is the wire form the encoding replaced: an HTTP-date is
+ * the value now. What the reference still asserts is `Instant`'s constraints. Validated as `Instant`,
+ * every HTTP-date was refused.
+ */
+function keptToZod(program, encoding, schemaOf) {
+    if (Array.isArray(encoding.kept)) {
+        return membersToZod(program, encoding.kept, (member) => keptMemberToZod(program, encoding, member) ?? typeToZod(program, member));
+    }
+    const kept = encoding.kept;
+    return keptMemberToZod(program, encoding, kept) ?? schemaOf(kept);
+}
+/**
+ * A declared scalar of the encoded scalar's JSON type, as the encoded scalar plus the declared one's
+ * constraints - or `undefined` where the member is read as itself. The encoding replaced the form the
+ * scalar's own check is for, unless it IS that form: `rfc3339` on a date-time, `ISO8601` on a
+ * duration.
+ */
+function keptMemberToZod(program, encoding, member) {
+    return replacesFormOf(program, encoding, member)
+        ? applyConstraints(program, scalarSchemaOf(program, encoding.scalar), member)
+        : undefined;
+}
+/** Whether a kept member is a scalar whose own check the encoding's wire form replaces. */
+export function replacesFormOf(program, encoding, member) {
+    if (member.kind !== "Scalar")
+        return false;
+    if (jsonTypeOfScalar(program, member) !== jsonTypeOfScalar(program, encoding.scalar))
+        return false;
+    const ownForm = (encoding.form === "rfc3339" && isDateTime(program, member)) ||
+        (encoding.form === "ISO8601" && isDuration(program, member));
+    return !ownForm;
+}
+/** Members of a declared type, as the one schema a union of them is. */
+function membersToZod(program, members, render = (member) => typeToZod(program, member), exclusive = false) {
+    if (members.every((member) => member.kind === "String")) {
+        const literals = members.map((member) => literal(member.value));
+        return `z.enum([${literals.join(", ")}])`;
+    }
+    const [only] = members;
+    if (members.length === 1 && only !== undefined)
+        return render(only);
+    return `${exclusive ? "z.xor" : "z.union"}([${members.map(render).join(", ")}])`;
+}
+/**
+ * **Whether a union is published as `oneOf`, where exactly one member may accept a value.**
+ * `@oneOf` is `@typespec/openapi3`'s decorator, on a union or on a property whose inline union it
+ * makes `oneOf`; openapi3 publishes `anyOf` otherwise. Read by its state key, which the library mints
+ * with `Symbol.for`, so this package depends on nothing it does not already. Validated as `z.union`,
+ * a value two members accept was accepted where the document refuses it; `z.xor` is the exclusive
+ * union.
+ */
+/**
+ * **Whether openapi3 publishes a union as `oneOf`**: a `@oneOf`, or a `@discriminated` union, whose
+ * variants it publishes as `oneOf` beside the discriminator mapping. A nested one is a member of its
+ * own, whole: spread into `DN | O2`, `@discriminated union DN { a: NA, b: NB }` lost its
+ * exclusivity, and under a PATCH `{}` - which both `NAUpdate` and `NBUpdate` accept, so `DNUpdate`
+ * refuses - was accepted.
+ */
+function isPublishedOneOf(program, union) {
+    return isExclusive(program, union) || getDiscriminatedUnion(program, union)[0] !== undefined;
+}
+export function isExclusive(program, target) {
+    return (program.stateMap(Symbol.for("@typespec/openapi3.oneOf")).get(target) === true ||
+        exclusiveWithoutNull.has(target));
+}
+/** The inline union a property's `@oneOf` makes exclusive, while the property's value renders. */
+let exclusiveSite;
+/** Whether a union is exclusive where it is rendered: its own `@oneOf`, or its property's. */
+export function isExclusiveHere(program, union) {
+    return isExclusive(program, union) || exclusiveSite === union;
+}
+/** The inline union a property's `@oneOf` makes exclusive; a named one is a `$ref` it leaves alone. */
+export function exclusiveSiteOf(program, property, declared) {
+    return isExclusive(program, property) && declared.kind === "Union" && !declared.name
+        ? declared
+        : undefined;
+}
+/**
+ * **Whether a `@oneOf` holds a member whose declaration is refused, or refers to one that is**, so
+ * that it validates nothing. openapi3 still publishes the member, and counts it: `@oneOf union O {
+ * a: S, b: N }` with `S` refused as `split-visibility` accepted `{"id": "i"}`, which matches both
+ * members in the document and so is refused there - `z.xor` counted the refused `S` as matching
+ * nothing. **A member holding a refused declaration further down is held stricter in the same way**:
+ * `@oneOf { v0: M16, v1: M13 }`, with `M13`'s `c?: M14` refused, accepted `{ c: {...}, e: "red" }`,
+ * which matches both in the document, as `M16` alone. Both walks ask it, so the validator and the
+ * contract type are `never` together.
+ */
+export function holdsRefusedMember(program, union, exclusive) {
+    if (!exclusive)
+        return false;
+    return [...union.variants.values()].some(({ type }) => {
+        if (type.kind !== "Model" && type.kind !== "Union")
+            return false;
+        return held.holdsRefusalAt(type, renderedVisibilityOf(program, type, visibility));
+    });
+}
+export function withExclusiveSite(site, run) {
+    const previous = exclusiveSite;
+    exclusiveSite = site;
+    try {
+        return run();
+    }
+    finally {
+        exclusiveSite = previous;
+    }
+}
+/**
+ * The members of a union a value's keywords leave, or `undefined` where the type is no union: a
+ * literal member breaking one is no value at all. Shared by both walks, so they list the same members.
+ */
+export function keptMembersOf(program, type, keywords) {
+    if (type.kind !== "Union" && type.kind !== "Enum")
+        return undefined;
+    return membersOf(type).filter((member) => {
+        const value = literalValueOf(member);
+        return (value === undefined ||
+            keywords.every((source) => brokenConstraintOf(program, source, value) === undefined));
+    });
+}
+/** The keywords that constrain anything, of the declarations a merged value carries. */
+export function constrainingKeywords(program, keywords) {
+    return keywords.filter((source) => hasConstraints(program, source));
+}
+/** A type with keywords on it, each applied to a member of its own JSON type. */
+function typeWithKeywordsToZod(program, type, keywords) {
+    const sources = constrainingKeywords(program, keywords);
+    if (sources.length === 0)
+        return typeToZod(program, type);
+    const members = keptMembersOf(program, type, sources);
+    if (members === undefined)
+        return constrainedMemberToZod(program, type, sources);
+    if (members.length === 0)
+        return UNREPRESENTABLE;
+    return membersToZod(program, members, (member) => constrainedMemberToZod(program, member, sources), isExclusive(program, type));
+}
+/** Keywords applied to a value of one JSON type; a model's are its own, read as declared. */
+function applyKeywords(program, expression, keywords, json) {
+    return keywords.reduce((each, source) => source.kind === "Model"
+        ? applyConstraints(program, each, source)
+        : applyConstraints(program, each, source, { type: json, quiet: true }), expression);
+}
+/** A merged value as Zod - see {@link Merged}. */
+function mergedToZod(program, value) {
+    switch (value.kind) {
+        case "never":
+        case "refused":
+            return UNREPRESENTABLE;
+        case "type": {
+            const typed = () => typeWithKeywordsToZod(program, value.type, value.keywords);
+            return value.at === undefined ? typed() : withVisibility(value.at, typed);
+        }
+        case "whole":
+            return propertyValueToZod(program, value.property).base;
+        case "nullable":
+            return `${mergedToZod(program, value.inner)}.nullable()`;
+        case "union": {
+            const strings = value.members.map((member) => member.kind === "type" && member.type.kind === "String" ? member.type.value : undefined);
+            // `z.enum` is one member of each value: an exclusive union matching a value twice refuses it.
+            if (value.exclusive !== true && strings.every((each) => each !== undefined)) {
+                return `z.enum([${strings.map((each) => literal(each)).join(", ")}])`;
+            }
+            const rendered = value.members.map((member) => mergedToZod(program, member));
+            if (value.exclusive === true)
+                return `z.xor([${rendered.join(", ")}])`;
+            const kept = rendered.flatMap((text, index) => rendered.indexOf(text) === index ? [index] : []);
+            noteWrittenMembers(program, value, kept);
+            const members = kept.map((index) => rendered[index]);
+            return members.length === 1 ? members[0] : `z.union([${members.join(", ")}])`;
+        }
+        case "all": {
+            const [first, ...rest] = value.parts.map((part) => mergedToZod(program, part));
+            return rest.reduce((each, part) => `${each}.and(${part})`, first ?? UNREPRESENTABLE);
+        }
+        case "array": {
+            const element = () => mergedToZod(program, value.element);
+            return applyKeywords(program, `z.array(${value.list === undefined ? element() : atItem(program, value.list, element)})`, value.keywords, "array");
+        }
+        case "object":
+            return objectToZod(program, value);
+    }
+}
+/**
+ * **The members a merged union is written with, by the validator and the contract type alike: one
+ * of each text the validator writes, in an `anyOf`.** `M19 | M19` merged with `Record<M19>` was two
+ * identical objects, whose two `z.input` types the wire assertion told apart from the one `Record` the
+ * contract type is (`TS2344`). Each walk deduplicating by its own text disagreed the other way: `S3`
+ * merged under `M1 | M2` is two objects the validator writes apart - `b` held to one `@minLength` and
+ * to two - and the contract type wrote as one, and TypeScript counts a union of two such objects as
+ * no object. So the validator decides, as it writes them, and the contract type writes the members
+ * it kept - see {@link noteWrittenMembers}. Repeated in a `@oneOf`, a value matching both is refused,
+ * so there each stays.
+ */
+export function membersToWrite(program, value) {
+    if (value.exclusive === true)
+        return value.members;
+    const kept = writtenMembers.get(program)?.get(mergedKeyOf(value));
+    return kept === undefined ? value.members : kept.map((index) => value.members[index]);
+}
+/** The members of each merged union the validator wrote, by the union's {@link mergedKeyOf}. */
+const writtenMembers = new WeakMap();
+function noteWrittenMembers(program, value, kept) {
+    let byKey = writtenMembers.get(program);
+    if (byKey === undefined) {
+        byKey = new Map();
+        writtenMembers.set(program, byKey);
+    }
+    byKey.set(mergedKeyOf(value), kept);
+}
+/**
+ * **A merged value's shape as text**, the same for the same value whichever walk merged it: each
+ * walk merges a position afresh, so the two values are alike and never one object. A TypeSpec type is
+ * itself, by an id of its own.
+ */
+function mergedKeyOf(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "undefined";
+    if ("entityKind" in value) {
+        let id = entityIds.get(value);
+        if (id === undefined) {
+            id = ++entityCount;
+            entityIds.set(value, id);
+        }
+        return `#${id}`;
+    }
+    if (Array.isArray(value))
+        return `[${value.map(mergedKeyOf).join(",")}]`;
+    return `{${Object.keys(value)
+        .toSorted()
+        .map((key) => `${JSON.stringify(key)}:${mergedKeyOf(value[key])}`)
+        .join(",")}}`;
+}
+const entityIds = new WeakMap();
+let entityCount = 0;
+/**
+ * An object as Zod: its members, and what it does with a key none of them names.
+ *
+ * Both a model and a merge of several end here, so a merged object is written by the rules a model
+ * is - and a model is just the merge of one.
+ */
+function objectToZod(program, object) {
+    const { rest } = object;
+    const site = object.site;
+    const restToZod = (value) => site === undefined
+        ? mergedToZod(program, value)
+        : withDeclarationSite(site, () => mergedToZod(program, value));
+    /**
+     * **A string indexer only means "dictionary" when the model declares NO properties.**
+     *
+     * `model X { id: string; ...Record<unknown> }` - the standard TypeSpec way to say "these fields,
+     * plus anything else", and what `@loose` was replaced by - carries both. Returning
+     * `z.record(...)` for it emits a schema that accepts an object and then **strips every declared
+     * field**, so `respond()`'s drift detection degrades to "is it an object" and the pinned fields
+     * silently stop being checked. This function's own history is the other half of the same mistake:
+     * it once keyed on the model's *name*, and lost the indexer of anything derived from `Record`.
+     */
+    if (object.dictionary && typeof rest !== "string") {
+        return applyKeywords(program, `z.record(z.string(), ${restToZod(rest)})`, object.keywords, "object");
+    }
+    if (object.dictionary && rest === "loose") {
+        return applyKeywords(program, "z.record(z.string(), z.unknown())", object.keywords, "object");
     }
     /**
-     * **`rfc3339` on a date-time is the form it already has, so it changes nothing.** openapi3's
-     * `mergeFormatAndEncoding` keeps `format: date-time` for it, and the type it reports, `string`,
-     * emitted `z.string()`: the explicit spelling of the default dropped the date-time check the
-     * document still states. Only the encodings that change the wire form - `rfc7231`,
-     * `unixTimestamp` - change the type.
+     * Permissiveness, read from the INDEXER and from nothing else.
+     *
+     * `...Record<unknown>` is the standard TypeSpec construct and the one `@typespec/openapi3` can
+     * see, so it is the only source. There was a second - `@loose`, a decorator of ours, invisible to
+     * the document - and it is gone: a model that accepted unknown properties while the published
+     * schema said otherwise is a runtime disagreeing with its own contract.
+     *
+     * An indexer over something other than `unknown` is a typed catchall, where `.loose()` would drop
+     * that value type on the floor.
+     *
+     * **`Record<never>` is how a spec says "and nothing else", not a value type to walk** - sealed,
+     * as `@typespec/openapi3` publishes it with `additionalProperties: {not: {}}`.
+     *
+     * A request model REJECTS an unrecognised field rather than stripping it. Silently dropping
+     * something a caller sent is the same failure this whole surface exists to remove, one layer out:
+     * the request succeeds and does less than it was asked to, with nothing anywhere reporting it.
      */
-    if (encoded.encoding === "rfc3339" && isDateTime(program, target))
-        return undefined;
-    if (target.kind === "ModelProperty" &&
-        isQueryParam(program, target) &&
-        PARAMETER_STYLE_ENCODINGS.has(encoded.encoding ?? "")) {
-        return undefined;
-    }
-    return encoded.type;
+    const catchall = typeof rest === "string" ? undefined : rest;
+    /**
+     * **A property that refers back into an unfinished declaration is emitted as a GETTER.**
+     *
+     * `model InnerModel { children?: InnerModel[] }` is a plain recursive tree, and openapi3 publishes
+     * it as a self-`$ref`. Emitting `children: z.array(innerModelSchema)` reads the `const` inside its
+     * own initialiser, so the module throws on import; deferring the reference behind a getter is the
+     * idiom Zod documents for exactly this, and it is the only one that keeps `z.infer` inferring the
+     * recursive type rather than collapsing to `any`. `z.lazy(() => innerModelSchema)` runs correctly
+     * but does not typecheck - measured: `TS7022`, "implicitly has type 'any' because it does not have
+     * a type annotation and is referenced directly or indirectly in its own initializer".
+     */
+    const members = object.members.map((member) => {
+        const key = objectKey(member.key);
+        const { property, position } = member;
+        if (property === undefined) {
+            const value = captureBackEdges(() => mergedToZod(program, position.value ?? NOTHING));
+            // Optional where no declaration requires it - an envelope's members under a PATCH.
+            const schema = position.required ? value.value : `${value.value}.exactOptional()`;
+            return {
+                deferred: value.deferred,
+                text: value.deferred
+                    ? `\tget ${key}() {\n\t\treturn ${schema};\n\t},`
+                    : `\t${key}: ${schema},`,
+            };
+        }
+        const { value, deferred } = captureBackEdges(() => withDeclarationSite(property, () => atPosition(position, () => atDeclaration(program, property, () => propertyToZod(program, property, position)))));
+        /**
+         * **A getter without a return type infers `unknown`, and the collapse is SILENT.**
+         *
+         * The docblock above claims the getter keeps `z.infer` inferring the recursive type. It does
+         * for the declaration itself, and not for a schema that WRAPS it: measured on the conformance
+         * corpus, `z.record(z.string(), innerModelSchema)` - what `@body body: Record<InnerModel>`
+         * emits - infers `children?: unknown`, and `.parse()` on it returns `unknown` outright. The
+         * generated server then failed to compile with `TS2322`, in `type/dictionary`, which is how
+         * this was found; nothing said the emitted TYPE was weaker than the document.
+         *
+         * Annotating the GETTER rather than the declaration is what keeps `.shape` and `.extend`,
+         * which inheritance and every group spread depend on. `: z.ZodType<T, T>` names both of Zod's
+         * parameters for the reason `renderSchemas` names both: one leaves the input side `unknown`.
+         */
+        const annotation = deferred
+            ? (atDeclaration(program, property, () => annotateDeferred(property, position)) ?? "")
+            : "";
+        return {
+            deferred,
+            text: deferred
+                ? `\tget ${key}()${annotation} {\n\t\treturn ${value};\n\t},`
+                : `\t${key}: ${value},`,
+        };
+    });
+    const entries = members.map((member) => member.text);
+    const suffix = rest === "loose"
+        ? ".loose()"
+        : catchall === undefined
+            ? ""
+            : `.catchall(${restToZod(catchall)})`;
+    const strict = rest === "sealed" ? ".strict()" : "";
+    /**
+     * **A deferred property forces the CONSTRUCTOR form of the object.**
+     *
+     * Measured on Zod 4.4.3: `.strict()`, `.loose()` and `.catchall()` all read `shape` eagerly, so
+     * each one fires the getter during module initialisation and throws `Cannot access 'X' before
+     * initialization` - the very thing the getter exists to avoid. `z.strictObject` and
+     * `z.looseObject` take the same shape without reading it.
+     *
+     * **So the constructor form is used wherever it exists, not only where a cycle forces it.** It is
+     * also what Zod 4 asks for: its own types say "Consider `z.looseObject(A.shape)` instead" on
+     * `.loose()` and `.strict()`, and `.passthrough()` is deprecated outright. Emitting one spelling
+     * means a model that gains a back edge later does not silently change form, and the eager-`shape`
+     * hazard above stops being something this walk has to keep reasoning about.
+     *
+     * **A TYPED catchall has no constructor form, and that used to be a refusal.** There is nowhere
+     * safe to put the getter - `.catchall()` reads `shape` eagerly - so the cycle was reported as
+     * `circular-model`. `z.lazy()` is the place to put it: wrapping the whole expression defers the
+     * getter past module initialisation, and by the time the schema is forced every declaration exists.
+     * Measured on 4.4.3: `z.lazy(() => z.object({ get kid() {...} }).catchall(z.number()))` parses a
+     * nested value and still applies the catchall.
+     */
+    const lazily = members.some((member) => member.deferred);
+    const constructible = suffix === "" || suffix === ".loose()";
+    const shape = entries.length === 0 ? "{}" : `{\n${entries.join("\n")}\n}`;
+    const body = constructible
+        ? `${suffix === ".loose()" ? "z.looseObject" : strict === ".strict()" ? "z.strictObject" : "z.object"}(${shape})`
+        : lazily
+            ? `z.lazy(() => z.object(${shape})${suffix}${strict})`
+            : `z.object(${shape})${suffix}${strict}`;
+    /**
+     * A model-level constraint goes through the same path as every other constraint. `.refine()`
+     * returns an effect rather than an object, so applying it after `.loose()` is the only order that
+     * works.
+     */
+    return applyKeywords(program, body, object.keywords, "object");
 }
-export function propertyToZod(program, property) {
+/**
+ * A property's VALUE as Zod - its type, encoding, constraints and nullability - without its
+ * optionality, its default or its description, which belong to the position.
+ */
+function propertyValueToZod(program, property, position = OWN_POSITION) {
     /**
      * **Constraints go INSIDE `.nullable()`, not after it.**
      *
@@ -1191,12 +4284,45 @@ export function propertyToZod(program, property) {
      * `.optional()` stays outermost: a constraint after it would apply to the optionality rather than
      * to the value.
      */
-    const nullable = nullableInnerOf(property.type);
-    // `@encode` on the property wins over its declared type - see `encodedTypeOf`. The nullable
-    // wrapper is kept: `@encode` changes what the value IS, not whether it may be absent.
-    const encoded = encodedTypeOf(program, property);
-    const declared = encoded ?? nullable ?? property.type;
-    const bare = nullable === undefined || encoded !== undefined;
+    /**
+     * `@encode` is read as `encodedValueOf` says the document publishes it, nullability included:
+     * openapi3 3.1 publishes `anyOf: [<the encoded value>, { type: "null" }]` where the encoding is
+     * applied beside `null`, and the encoded `type` rules `null` out where it is applied to the whole.
+     */
+    const encoding = encodedValueOf(program, property);
+    /**
+     * **A named union is its own declaration**, where nothing about the position is applied to its
+     * members: openapi3 publishes `m: MaybeN1<ItemN1>` as `$ref: MaybeN1`, and the contract types
+     * declare `MaybeN1`. Peeled to `itemN1Schema.nullable()` here, it had no validator.
+     */
+    const whole = property.type.kind === "Union" &&
+        !shouldInline(program, property.type) &&
+        encoding.kind === "declared" &&
+        !position.nonNull &&
+        position.constrainedBy.length === 0 &&
+        !hasConstraints(program, property);
+    const nullable = whole ? undefined : peeledNullOf(program, property);
+    if (encoding.kind === "unsatisfiable") {
+        reportUnsatisfiableEncoding(program, property, {
+            name: property.name,
+            declared: nameOfType(encoding.declared),
+            encoded: encoding.scalar.name,
+            why: encoding.why,
+        });
+    }
+    // A declaration above refusing `null` leaves the value without it - see `PropertyPosition`.
+    const bare = position.nonNull ||
+        (encoding.kind === "declared"
+            ? nullable === undefined
+            : encoding.kind === "unsatisfiable" || !encoding.nullable);
+    /** The type whose schema is the value, for the description a scalar carries. */
+    const declared = encoding.kind === "declared"
+        ? (nullable ?? property.type)
+        : encoding.kind === "replaced"
+            ? encoding.scalar
+            : encoding.kind === "both" && !Array.isArray(encoding.kept)
+                ? encoding.kept
+                : property.type;
     /**
      * **One description per position, and a property's own doc wins over its scalar's.**
      *
@@ -1212,10 +4338,60 @@ export function propertyToZod(program, property) {
      * branch and only the property's belongs to the property.
      */
     const inlinedScalar = bare && declared.kind === "Scalar";
-    const value = inlinedScalar ? scalarSchemaOf(program, declared) : typeToZod(program, declared);
-    const constrained = applyConstraints(program, value, property);
+    // A property's `@oneOf` makes its INLINE union exclusive; a named one is a `$ref` it leaves alone.
+    const exclusive = exclusiveSiteOf(program, property, declared);
+    const schemaOf = (type) => bare && type.kind === "Scalar"
+        ? scalarSchemaOf(program, type)
+        : withExclusiveSite(exclusive, () => typeToZod(program, type));
+    let constrained;
+    switch (encoding.kind) {
+        case "unsatisfiable":
+            constrained = UNREPRESENTABLE;
+            break;
+        case "declared": {
+            const sources = [property, ...position.constrainedBy];
+            const members = constrainedMembersOf(program, property, position);
+            constrained =
+                members === undefined
+                    ? withAncestors(program, applyConstraints(program, schemaOf(declared), property), property, position)
+                    : members.length === 0
+                        ? UNREPRESENTABLE
+                        : membersToZod(program, members, (member) => constrainedMemberToZod(program, member, sources), exclusive !== undefined || isExclusive(program, declared));
+            break;
+        }
+        case "replaced":
+            constrained = withAncestors(program, applyConstraints(program, schemaOf(encoding.scalar), property), property, position);
+            break;
+        case "both": {
+            /**
+             * The property's own constraints are applied to the encoded scalar's schema, never to an
+             * intersection, which carries no `.min` or `.regex`; the kept type brings its own.
+             */
+            const kept = keptToZod(program, encoding, schemaOf);
+            constrained = !encodedIntersects(program, property, encoding)
+                ? applyConstraints(program, kept, property)
+                : `${applyConstraints(program, scalarSchemaOf(program, encoding.scalar), property)}.and(${kept})`;
+            break;
+        }
+    }
     const base = bare ? constrained : `${constrained}.nullable()`;
     const description = getDoc(program, property) ?? (inlinedScalar ? scalarDocOf(program, declared) : undefined);
+    return { base, description };
+}
+export function propertyToZod(program, property, position = OWN_POSITION) {
+    if (position.refused !== undefined)
+        reportUnrepresentableOverride(program, property, position);
+    // Merged with the declarations above it where the value narrows none - see `mergeParts`.
+    const own = position.value === undefined
+        ? atReading(program, property, () => propertyValueToZod(program, property, position))
+        : { base: mergedToZod(program, position.value), description: getDoc(program, property) };
+    // What the declarations above it leave of the value - see `PropertyPosition`.
+    const base = position.never || position.refused !== undefined
+        ? UNREPRESENTABLE
+        : position.nullOnly
+            ? "z.null()"
+            : own.base;
+    const { description } = own;
     /**
      * **Optionality is a function of the position too, not only of the `?` in the spec.**
      *
@@ -1225,8 +4401,12 @@ export function propertyToZod(program, property) {
      * would reject every partial update the contract invites. `metadataInfo.isOptional` is the same
      * predicate `@typespec/openapi3` uses to decide the `required` list.
      */
-    const optional = property.optional || isOptionalAt(program, property);
+    const optional = !position.required && (property.optional || isOptionalAt(program, property));
     reportInheritedName(program, property, optional);
+    // A value nothing satisfies takes no default: there is no value to fall back to.
+    if (refusedValue(program, property, position)) {
+        return described(optional ? `${base}.exactOptional()` : base, description);
+    }
     /**
      * **A default only applies where the document says the property may be absent.**
      *
@@ -1243,11 +4423,19 @@ export function propertyToZod(program, property) {
      * about a value that cannot be reached either way, naming the less useful of the two problems.
      */
     if (!optional && property.defaultValue !== undefined) {
-        reportDiagnostic(program, {
-            code: "default-on-required-property",
-            target: property,
-            format: { name: property.name },
-        });
+        // Required by its position rather than its `?`: a discriminator, or a declaration above it.
+        const imposed = position.required && (property.optional || isOptionalAt(program, property));
+        const discriminator = imposed &&
+            property.model !== undefined &&
+            discriminatorsOf(program, property.model).includes(rawPropertyKey(program, property));
+        if (firstReportOf(program, "default-on-required-property", property)) {
+            reportDiagnostic(program, {
+                code: "default-on-required-property",
+                messageId: discriminator ? "discriminator" : imposed ? "ancestor" : "default",
+                target: property,
+                format: { name: property.name },
+            });
+        }
         return described(base, description);
     }
     /**
@@ -1257,9 +4445,19 @@ export function propertyToZod(program, property) {
      * already accepts an absent value, and the two together would make the OUTPUT optional as well,
      * so the fallback could be skipped.
      */
-    const defaulted = defaultOf(program, property);
-    if (defaulted !== undefined)
-        return described(`${base}.default(${defaulted})`, description);
+    const defaulted = defaultOf(program, property, position);
+    if (defaulted !== undefined) {
+        /**
+         * **A default no literal of the validator's type spells is the validator's own parse of it** -
+         * see {@link setsKeyItsIndexerRefuses}. The value is the same: it was held to the schema above,
+         * and a parse of a valid value is that value with its defaults filled, as the literal is.
+         */
+        const value = jsonLiteral(defaulted);
+        const fallback = setsKeyItsIndexerRefuses(program, property.type, defaulted)
+            ? `() => ${base}.parse(${value})`
+            : value;
+        return described(`${base}.default(${fallback})`, description);
+    }
     /**
      * **`.exactOptional()`, because the document says the KEY may be absent and nothing more.**
      *
@@ -1339,58 +4537,6 @@ function wireNameOf(program, property) {
     }
     return rawPropertyKey(program, property);
 }
-/**
- * A default value as a JS literal, or `undefined` where this emitter cannot render one.
- *
- * **Composite defaults used to be REFUSED, and the refusal was wrong on the emitter's own
- * governing rule.** `#["a", "b"]` and `#{ x: 1 }` were reported as `unsupported-default` with the
- * reason "a populated literal default would need each element rendered, and no schema here has one".
- * That was a statement about this function rather than about what can be represented: `.default()`
- * takes any JS value, and `@typespec/openapi3` publishes these exactly -
- * `default: ["a","b"]`, `default: {"x":1,"label":"hi"}`, and nested arrays too, measured from one
- * compile of a spec carrying all three. So the document could say it, Zod could enforce it, and only
- * this emitter refused - which is the same spec being representable by one emitter and not the other,
- * the one thing a differential between them cannot tolerate.
- *
- * **The refusal also emitted `.default(z.never())`**, because `UNREPRESENTABLE` is a schema
- * expression and this position wants a VALUE. Had the diagnostic ever been downgraded to a warning,
- * that would have compiled and set every such default to a Zod object.
- *
- * A value is pure data - strings, numbers, booleans, null, and arrays and objects of those - so it
- * renders as JSON. Anything else stays a refusal, and `ScalarValue` is the live case: a default like
- * `utcDateTime.fromISO(...)` is a constructor call rather than a literal.
- */
-function renderValue(value) {
-    if (value.valueKind === "StringValue")
-        return literal(value.value);
-    if (value.valueKind === "NumericValue")
-        return String(value.value.asNumber());
-    if (value.valueKind === "BooleanValue")
-        return String(value.value);
-    if (value.valueKind === "NullValue")
-        return "null";
-    if (value.valueKind === "EnumValue") {
-        const member = value.value;
-        return literal(member.value ?? member.name);
-    }
-    if (value.valueKind === "ArrayValue") {
-        const rendered = value.values.map(renderValue);
-        // One unrenderable element makes the whole literal unrenderable - a partial array would be a
-        // different default from the one the spec declares, which is worse than refusing.
-        return rendered.some((entry) => entry === undefined) ? undefined : `[${rendered.join(", ")}]`;
-    }
-    if (value.valueKind === "ObjectValue") {
-        const entries = [];
-        for (const [name, descriptor] of value.properties) {
-            const rendered = renderValue(descriptor.value);
-            if (rendered === undefined)
-                return undefined;
-            entries.push(`${literal(name)}: ${rendered}`);
-        }
-        return `{${entries.join(", ")}}`;
-    }
-    return undefined;
-}
 /**
  * **Whether `propertyToZod` emits `.default(...)` for this property, which is exactly whether its
  * INPUT admits an explicit `undefined`.**
@@ -1403,34 +4549,483 @@ function renderValue(value) {
  *
  * Pure: it reports nothing, so the type walk can ask it without duplicating a diagnostic.
  */
-export function emitsDefault(program, property) {
-    const optional = property.optional || isOptionalAt(program, property);
-    return (optional &&
-        property.defaultValue !== undefined &&
-        renderValue(property.defaultValue) !== undefined);
+export function emitsDefault(program, property, position = OWN_POSITION) {
+    const optional = !position.required && (property.optional || isOptionalAt(program, property));
+    if (!optional ||
+        property.defaultValue === undefined ||
+        refusedValue(program, property, position)) {
+        return false;
+    }
+    const serialized = defaultJsonOf(program, property);
+    return (serialized !== undefined &&
+        defaultClashOf(program, property, position, serialized.json) === undefined);
+}
+/**
+ * Whether the value at this position validates nothing - refused, or no value of it is valid - so
+ * it takes no default: there is nothing to fall back to, and `z.never().default(...)` does not
+ * compile.
+ */
+function refusedValue(program, property, position) {
+    if (position.never || position.nullOnly || position.refused !== undefined)
+        return true;
+    if (encodedValueOf(program, property).kind === "unsatisfiable")
+        return true;
+    const declared = nullableInnerOf(property.type) ?? property.type;
+    // A tuple parameter is refused as `unsupported-type`.
+    return declared.kind === "Tuple" && parameterPosition;
+}
+/**
+ * **Why a default is no value the position accepts, or `undefined` where it is one.**
+ *
+ * A default is written in the declared type and published as the JSON openapi3 serializes it, and
+ * that is not always a value of the schema it sits beside. `@encode` can change the type under it -
+ * `@encode(string) count?: int32 = 5` is `{ type: "string", default: 5 }`, and a scalar built on an
+ * encoded scalar carries the encoding too; a property's constraints can rule out a union's literal
+ * the default names; a key the default sets can be one the position does not publish - a read-only
+ * property in a create body, a model the document only knows as a union member. Filled in, any of
+ * these handed the handler a value its type says it cannot hold, and the emitted module did not
+ * compile. No fallback is both the document's and a valid value, so none is emitted, and
+ * `invalid-default` says why. Checked member by member through lists, records and objects.
+ */
+function defaultClashOf(program, property, position, json) {
+    /**
+     * **An integer past what a JSON number holds exactly is published as `null`** - `int64 = 2^53 + 1`
+     * - and was reported as though the author had written `null`.
+     */
+    const written = property.defaultValue;
+    if (json === null && written?.valueKind === "NumericValue") {
+        return `it is ${written.value.toString()}, which no JSON number holds exactly, and openapi3 publishes it as null`;
+    }
+    const clash = valueClashOf(program, property, position, json);
+    /**
+     * **Where openapi3 publishes fewer keys than the default sets, the message says so**: an object
+     * default on a union-typed property is serialized as `{}`, and "it leaves out 'kind'" read as
+     * though the spec had.
+     */
+    if (clash !== undefined &&
+        written?.valueKind === "ObjectValue" &&
+        json !== null &&
+        typeof json === "object" &&
+        Object.keys(json).length < written.properties.size) {
+        return `openapi3 publishes it as ${JSON.stringify(json)}, without keys it sets, and ${clash}`;
+    }
+    return clash;
+}
+/**
+ * **Why a JSON value is no value of a property at its position, or `undefined` where it is one** -
+ * asked of a default, and of each key a default sets, at that key's own position.
+ */
+function valueClashOf(program, property, position, json) {
+    // Every declaration above holds the value too, merged or implied - a `null` one refuses included.
+    for (const ancestor of position.ancestors) {
+        const clash = jsonClashOf(program, json, valueJsonTypesOf(program, ancestor), ancestor.type);
+        if (clash !== undefined)
+            return clash;
+    }
+    /**
+     * **The check its own scalar emits** - a width, a format - which the document publishes as
+     * `format` and JSON Schema reads as an annotation, so no keyword above says it: a `plainDate` of
+     * February 30th, a `url` that is no URL, a date past what an `int32` timestamp encodes. Each was
+     * filled in, and refused when sent back. Asked of the encoded scalar where `@encode` replaces the
+     * value's type, as the validator asks it - and first, since a keyword `@encode` moves onto a type it
+     * does not apply to is dropped: `@encode(string) @minValue(5) low?: int32 = 3` is no string, and
+     * was reported as breaking the `@minValue` the validator does not enforce.
+     */
+    const declared = nullableInnerOf(property.type) ?? property.type;
+    const encoding = encodedValueOf(program, property);
+    const validated = encoding.kind === "replaced" || encoding.kind === "both"
+        ? encoding.scalar
+        : declared.kind === "Scalar"
+            ? declared
+            : undefined;
+    if (validated !== undefined &&
+        json !== null &&
+        scalarAccepts(program, validated, json) === false) {
+        return `it is no '${validated.name}' the validator accepts`;
+    }
+    /**
+     * **And every keyword on the way: the property's, each declaration's above it, and its declared
+     * scalar's.** `@minValue(10) mv?: int32 = 5` filled a `5` the same validator refuses when it is
+     * sent, and the handler was handed it.
+     */
+    const broken = keywordClashOf(program, json, [
+        property,
+        ...position.constrainedBy,
+        ...position.ancestors,
+        ...(declared.kind === "Scalar" ? [declared] : []),
+    ]);
+    if (broken !== undefined)
+        return `it breaks ${broken}`;
+    /**
+     * **A merged value is the one schema the document holds it to**, so it is asked whole: what no
+     * declaration states is part of it - the value of a typed indexer of a model merged with this
+     * one, which holds every key that model does not name. `Root { u: B | A }` with `A` a
+     * `Record<Small>` and `Sub { u: B2 }` filled `B2`'s `k = 7` into the `A` branch, where `Small`
+     * refuses it.
+     */
+    if (position.value !== undefined) {
+        const clash = mergedClashOf(program, json, position.value);
+        if (clash !== undefined)
+            return clash;
+    }
+    const members = position.value === undefined ? constrainedMembersOf(program, property, position) : undefined;
+    if (members !== undefined) {
+        const fits = (json === null && hasNull(property.type)) ||
+            members.some((member) => jsonClashOf(program, json, jsonTypesOf(program, member), member) === undefined);
+        return fits ? undefined : "it is no value of the members the property's constraints leave";
+    }
+    return jsonClashOf(program, json, valueJsonTypesOf(program, property), property.type);
+}
+/** The first keyword of these declarations a JSON value breaks, for its own JSON type. */
+function keywordClashOf(program, json, sources) {
+    for (const source of sources) {
+        const broken = typeof json === "string" || typeof json === "number"
+            ? brokenConstraintOf(program, source, json)
+            : Array.isArray(json)
+                ? brokenItemsOf(program, source, json.length)
+                : undefined;
+        if (broken !== undefined)
+            return broken;
+    }
+    return undefined;
+}
+/** Why a JSON value does not fit a declared type, by kind and then member by member, or `undefined`. */
+function jsonClashOf(program, json, types, type) {
+    const kind = jsonTypeOfValue(json);
+    const fits = types === undefined ||
+        types.has(kind) ||
+        (kind === "integer" && types.has("number")) ||
+        (kind === "number" && types.has("fraction"));
+    if (!fits) {
+        const expected = [...(types ?? [])].filter((each) => each !== "null").join(" or ");
+        return `it is a JSON ${kind}, and the value is a JSON ${expected}`;
+    }
+    const declared = nullableInnerOf(type) ?? type;
+    /**
+     * **A literal admits its own value and no other, and an enum or a union of literals its members'.**
+     * Read by JSON type alone, a default a literal above refuses was filled in: `Leaf { kk?: string =
+     * "abcd" }` named `k` with `@encodedName` over `Root { k?: "b" }`, which the compiler does not hold
+     * `kk` to, and `M14 { a?: string = "a" }` merged into `Record<Color.red>`, were emitted as
+     * `z.literal("b").default("abcd")`, refused when sent back, and the module failed to typecheck.
+     */
+    const fixed = literalValuesOfType(declared);
+    if (fixed !== undefined &&
+        (typeof json === "string" || typeof json === "number" || typeof json === "boolean") &&
+        !admitsValue(program, declared, json)) {
+        return `it is ${JSON.stringify(json)}, and the value is ${fixed.map((value) => JSON.stringify(value)).join(" or ")}`;
+    }
+    // A declared scalar's keywords, and a named list model's, hold at every depth.
+    if (declared.kind === "Scalar" || declared.kind === "Model") {
+        const broken = keywordClashOf(program, json, [declared]);
+        if (broken !== undefined)
+            return `it breaks ${broken}`;
+    }
+    if (declared.kind === "Union" && kind !== "null") {
+        const members = membersOf(declared).filter((member) => !isNull(member));
+        const clashes = members.map((member) => jsonClashOf(program, json, jsonTypesOf(program, member), member));
+        return clashes.includes(undefined) ? undefined : clashes[0];
+    }
+    if (declared.kind !== "Model")
+        return undefined;
+    const element = declared.indexer?.key.name === "integer" ? declared.indexer.value : undefined;
+    if (Array.isArray(json) && element !== undefined) {
+        for (const item of json) {
+            const clash = jsonClashOf(program, item, jsonTypesOf(program, element), element);
+            if (clash !== undefined)
+                return clash;
+        }
+        return undefined;
+    }
+    if (kind !== "object")
+        return undefined;
+    const entries = Object.entries(json);
+    // A record of values, each checked as its value type.
+    if (declared.indexer?.key.name === "string" && declared.properties.size === 0) {
+        const value = declared.indexer.value;
+        for (const [, each] of entries) {
+            const clash = jsonClashOf(program, each, jsonTypesOf(program, value), value);
+            if (clash !== undefined)
+                return clash;
+        }
+        return undefined;
+    }
+    /**
+     * **Each key at its own position, the declarations above it included**, read where the model is
+     * rendered. Held to its own declaration alone, `o?: KS = #{ k: "toolong" }` was filled in where
+     * `KS extends KB` and `KB` declares `@maxLength(3) k`: `KS`'s `allOf` refuses it.
+     */
+    return withVisibility(renderedVisibilityOf(program, declared, visibility), () => {
+        const published = publishedPropertiesOf(program, declared).map((entry) => ({
+            entry,
+            key: rawPropertyKey(program, entry.property),
+            position: positionOf(program, declared, entry),
+        }));
+        for (const [key, value] of entries) {
+            const each = published.find((candidate) => candidate.key === key);
+            if (each === undefined) {
+                if (declared.indexer === undefined && isSealed(declared))
+                    return `it sets '${key}', which the value does not declare here`;
+                continue;
+            }
+            const clash = valueClashOf(program, each.entry.property, each.position, value);
+            if (clash !== undefined)
+                return `at '${key}', ${clash}`;
+        }
+        const missing = published.find(({ entry, key, position }) => (position.required ||
+            !(entry.property.optional || isOptionalAt(program, entry.property))) &&
+            !entries.some(([sent]) => sent === key));
+        return missing === undefined ? undefined : `it leaves out '${missing.key}', which is required`;
+    });
+}
+/**
+ * **Why a JSON value is no value of a merged schema**, read as the validator it renders reads it -
+ * see {@link Merged}. A refusal is reported where it is found, so it clashes with nothing here.
+ */
+function mergedClashOf(program, json, merged) {
+    const kind = jsonTypeOfValue(json);
+    switch (merged.kind) {
+        case "never":
+            return "no value is valid where it is filled in";
+        case "refused":
+            return undefined;
+        case "type": {
+            const clash = withVisibility(merged.at ?? visibility, () => jsonClashOf(program, json, jsonTypesOf(program, merged.type), merged.type));
+            if (clash !== undefined)
+                return clash;
+            const broken = keywordClashOf(program, json, merged.keywords);
+            return broken === undefined ? undefined : `it breaks ${broken}`;
+        }
+        case "whole":
+            return valueClashOf(program, merged.property, OWN_POSITION, json);
+        case "nullable":
+            return json === null ? undefined : mergedClashOf(program, json, merged.inner);
+        case "all":
+            for (const part of merged.parts) {
+                const clash = mergedClashOf(program, json, part);
+                if (clash !== undefined)
+                    return clash;
+            }
+            return undefined;
+        case "union": {
+            const clashes = merged.members.map((member) => mergedClashOf(program, json, member));
+            const fits = clashes.filter((clash) => clash === undefined).length;
+            if (merged.exclusive === true ? fits === 1 : fits > 0)
+                return undefined;
+            return fits > 1
+                ? "it is a value of more than one member of a '@oneOf' union"
+                : (clashes[0] ?? "it is no value of the union");
+        }
+        case "array": {
+            if (!Array.isArray(json))
+                return `it is a JSON ${kind}, and the value is a JSON array`;
+            const broken = keywordClashOf(program, json, merged.keywords);
+            if (broken !== undefined)
+                return `it breaks ${broken}`;
+            for (const item of json) {
+                const clash = mergedClashOf(program, item, merged.element);
+                if (clash !== undefined)
+                    return clash;
+            }
+            return undefined;
+        }
+        case "object": {
+            if (kind !== "object")
+                return `it is a JSON ${kind}, and the value is a JSON object`;
+            const entries = Object.entries(json);
+            for (const [key, value] of entries) {
+                const member = merged.members.find((each) => each.key === key);
+                if (member === undefined) {
+                    if (merged.rest === "sealed") {
+                        return `it sets '${key}', which the value does not declare here`;
+                    }
+                    const clash = typeof merged.rest === "string"
+                        ? undefined
+                        : mergedClashOf(program, value, merged.rest);
+                    if (clash !== undefined)
+                        return `at '${key}', ${clash}`;
+                    continue;
+                }
+                const clash = member.property === undefined
+                    ? member.position.value === undefined
+                        ? undefined
+                        : mergedClashOf(program, value, member.position.value)
+                    : valueClashOf(program, member.property, member.position, value);
+                if (clash !== undefined)
+                    return `at '${key}', ${clash}`;
+            }
+            // A merged member's position says whether any declaration of the key requires it.
+            const missing = merged.members.find((member) => member.position.required && !entries.some(([sent]) => sent === member.key));
+            return missing === undefined
+                ? undefined
+                : `it leaves out '${missing.key}', which is required`;
+        }
+    }
 }
-/** A property's declared default, as a JS literal, or `undefined` when it has none. */
-function defaultOf(program, property) {
+/**
+ * **A default as the document publishes it**: openapi3's `serializeValueAsJson` - wire names for an
+ * object's keys, a scalar constructor written through the property's encoding, so
+ * `utcDateTime.fromISO("2020-01-01T00:00:00Z")` under `unixTimestamp` is `1577836800`. `undefined`
+ * where it cannot be serialized, which openapi3 reports as `default-not-supported`.
+ */
+function defaultJsonOf(program, property) {
     const value = property.defaultValue;
     if (value === undefined)
         return undefined;
-    const rendered = renderValue(value);
-    if (rendered !== undefined)
-        return rendered;
-    reportDiagnostic(program, {
-        code: "unsupported-default",
-        target: property,
-        format: { why: `kind "${value.valueKind}"` },
+    try {
+        const json = serializeValueAsJson(program, value, property);
+        return json === undefined ? undefined : { json };
+    }
+    catch {
+        return undefined;
+    }
+}
+function jsonTypeOfValue(json) {
+    if (json === null)
+        return "null";
+    if (Array.isArray(json))
+        return "array";
+    if (typeof json === "number")
+        return Number.isInteger(json) ? "integer" : "number";
+    return typeof json;
+}
+/** A JSON value as a JS literal, every string through `literal` so the module stays ASCII. */
+function jsonLiteral(json) {
+    if (typeof json === "string")
+        return literal(json);
+    if (Array.isArray(json))
+        return `[${json.map(jsonLiteral).join(", ")}]`;
+    if (json !== null && typeof json === "object") {
+        return `{${Object.entries(json)
+            .map(([key, value]) => `${literal(key)}: ${jsonLiteral(value)}`)
+            .join(", ")}}`;
+    }
+    return String(json);
+}
+/** A property's declared default, as the JSON the document publishes filled in, or `undefined`. */
+function defaultOf(program, property, position) {
+    const value = property.defaultValue;
+    if (value === undefined)
+        return undefined;
+    const serialized = defaultJsonOf(program, property);
+    if (serialized === undefined) {
+        reportDiagnostic(program, {
+            code: "unsupported-default",
+            target: property,
+            format: { why: `kind "${value.valueKind}"` },
+        });
+        /**
+         * **No `.default(...)` at all, rather than a default this emitter invented.** The property keeps
+         * its declared shape and loses only the fallback, which the diagnostic names.
+         */
+        return undefined;
+    }
+    const clash = defaultClashOf(program, property, position, serialized.json);
+    if (clash !== undefined) {
+        if (firstReportOf(program, "invalid-default", property)) {
+            reportDiagnostic(program, {
+                code: "invalid-default",
+                target: property,
+                format: { name: property.name, why: clash },
+            });
+        }
+        return undefined;
+    }
+    return filledDefaultOf(program, property.type, serialized.json);
+}
+/**
+ * **Whether a default sets, at any depth, a declared key of an object whose typed indexer refuses the
+ * key's value**, which no literal of the validator's type can do. Zod types `.catchall()` over every
+ * key, declared ones included, so `ObjIdx { s?: string; ...Record<int32> }` is `{ [x: string]:
+ * number; s?: string }`, and TypeScript holds `s` to both: `r?: ObjIdx = #{ s: "x" }`, which the
+ * document and the validator accept, was emitted as `.default({"s": "x"})` and the module failed to
+ * typecheck, `TS2769`, the default no value of the type. A key the indexer holds as well, `#{ k: 1 }`,
+ * is one.
+ */
+function setsKeyItsIndexerRefuses(program, type, json) {
+    const declared = nullableInnerOf(type) ?? type;
+    if (json === null || typeof json !== "object")
+        return false;
+    if (declared.kind === "Union") {
+        return membersOf(declared).some((member) => setsKeyItsIndexerRefuses(program, member, json));
+    }
+    if (declared.kind !== "Model")
+        return false;
+    if (Array.isArray(json)) {
+        const element = declared.indexer?.key.name === "integer" ? declared.indexer.value : undefined;
+        return (element !== undefined &&
+            json.some((item) => setsKeyItsIndexerRefuses(program, element, item)));
+    }
+    return withVisibility(renderedVisibilityOf(program, declared, visibility), () => {
+        const object = objectOfModel(program, declared);
+        if (object.kind !== "object")
+            return false;
+        const rest = typeof object.rest === "string" ? undefined : object.rest;
+        return Object.entries(json).some(([key, value]) => {
+            const member = object.members.find((each) => each.key === key);
+            if (member === undefined || object.dictionary) {
+                return rest?.kind === "type" && setsKeyItsIndexerRefuses(program, rest.type, value);
+            }
+            if (rest !== undefined && mergedClashOf(program, value, rest) !== undefined)
+                return true;
+            return (member.property !== undefined &&
+                setsKeyItsIndexerRefuses(program, member.property.type, value));
+        });
+    });
+}
+/**
+ * **A default as the validator hands it over: the document's value, with the default of every key it
+ * leaves out filled in, at any depth.** `.default()` hands its value over unparsed, so
+ * `inner?: Inner = #{ b: "x" }` beside `Inner`'s own `a?: int32 = 1` gave the handler an `Inner` with
+ * no `a`, and the module did not typecheck: the value is the validator's OUTPUT, where `a` is filled.
+ * Filled here, it is the value a parse of the document's default produces.
+ */
+function filledDefaultOf(program, type, json) {
+    const declared = nullableInnerOf(type) ?? type;
+    if (declared.kind !== "Model" || json === null || typeof json !== "object")
+        return json;
+    const indexed = declared.indexer;
+    if (Array.isArray(json)) {
+        return indexed?.key.name === "integer"
+            ? json.map((item) => filledDefaultOf(program, indexed.value, item))
+            : json;
+    }
+    const own = (target, key, value) => {
+        // Defined as an own key, so a key named `__proto__` is a key and not the prototype.
+        Object.defineProperty(target, key, {
+            value,
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    };
+    const filled = {};
+    if (indexed?.key.name === "string" && declared.properties.size === 0) {
+        for (const [key, value] of Object.entries(json)) {
+            own(filled, key, filledDefaultOf(program, indexed.value, value));
+        }
+        return filled;
+    }
+    for (const [key, value] of Object.entries(json))
+        own(filled, key, value);
+    return withVisibility(renderedVisibilityOf(program, declared, visibility), () => {
+        for (const entry of publishedPropertiesOf(program, declared)) {
+            const key = rawPropertyKey(program, entry.property);
+            if (Object.prototype.hasOwnProperty.call(filled, key)) {
+                own(filled, key, filledDefaultOf(program, entry.property.type, filled[key]));
+                continue;
+            }
+            if (!emitsDefault(program, entry.property, positionOf(program, declared, entry)))
+                continue;
+            const inner = defaultJsonOf(program, entry.property);
+            if (inner !== undefined) {
+                own(filled, key, filledDefaultOf(program, entry.property.type, inner.json));
+            }
+        }
+        return filled;
     });
-    /**
-     * **No `.default(...)` at all, rather than a default this emitter invented.** Returning
-     * `UNREPRESENTABLE` here put a schema expression where a value belongs. The property keeps its
-     * declared shape and loses only the fallback, which the diagnostic names.
-     */
-    return undefined;
 }
 /** The non-null half of a two-variant `T | null` union, or `undefined` if it is not one. */
-function nullableInnerOf(type) {
+export function nullableInnerOf(type) {
     if (type.kind !== "Union")
         return undefined;
     const variants = [...type.variants.values()].map((variant) => variant.type);
@@ -1501,12 +5096,31 @@ export function typeToZod(program, type) {
  * occurrences still go through {@link typeToZod} and do resolve - which is what makes a recursive
  * model reference itself instead of inlining itself forever.
  */
+/**
+ * **An instance of a list template is refused**: `model Page<T> is T[]` made `Page<Item>`, which
+ * openapi3 emits as a template instance - an object - and publishes as `type: object` with the
+ * element as `additionalProperties`, a dictionary where the spec declares a list. No validator agrees
+ * with both. A named list per element type, `model Items is Item[]`, or `Item[]` itself, is a list in
+ * the document too.
+ */
+export function listTemplateInstanceWhy(program, type) {
+    return type.templateMapper !== undefined &&
+        type.indexer?.key.name === "integer" &&
+        !isArrayLiteral(program, type)
+        ? "an instance of a list template, which openapi3 publishes as an object of its elements, not a list"
+        : undefined;
+}
+export const LIST_TEMPLATE_REMEDY = "Declare a named list model per element type, `model Items is Item[]`, or use `Item[]` itself.";
 export function typeToZodBody(program, type) {
     switch (type.kind) {
         case "Scalar":
             return scalarToZod(program, type);
-        case "Model":
+        case "Model": {
+            const why = listTemplateInstanceWhy(program, type);
+            if (why !== undefined)
+                return refuse(program, type, why, LIST_TEMPLATE_REMEDY);
             return modelToZod(program, type);
+        }
         case "Enum":
             return enumToZod(program, type);
         case "Union":
@@ -1536,9 +5150,26 @@ export function typeToZodBody(program, type) {
             if (type.name === "unknown")
                 return "z.unknown()";
             if (type.name === "void" || type.name === "never") {
-                return refuse(program, type, `\`${type.name}\` has no runtime representation`, "Give the position a type a value can inhabit. A `never` PROPERTY is dropped to match the document, and `Record<never>` seals the model, so neither of those reaches here.");
+                return refuse(program, type, `\`${type.name}\` has no runtime representation`, "Give the position a type a value can inhabit. A `never` property or parameter is dropped to match the document, and `Record<never>` seals the model, so none of those reaches here.");
             }
             return refuse(program, type, `intrinsic "${type.name}"`, "This emitter has no rule for that intrinsic. Replace it with a declared scalar or model.");
+        /**
+         * **openapi3 publishes a tuple as `prefixItems`, with no `items` or `minItems` beside it**:
+         * any length, each position checked where it is present, anything past the last. That is a
+         * tuple whose every position is optional and whose rest is `unknown` - `z.tuple([...],
+         * z.unknown())`, which `z.toJSONSchema` gives back as the same `prefixItems`. Refused as a
+         * parameter - see `parameterPosition`. Refused outright, an OAuth2 flow model, whose `scopes`
+         * is a tuple and which openapi3 publishes as a component, stopped a service compiling.
+         */
+        case "Tuple": {
+            if (parameterPosition)
+                return refuse(program, type, TUPLE_PARAMETER.why, TUPLE_PARAMETER.remedy);
+            const positions = type.values.map((value) => `${typeToZod(program, value)}.exactOptional()`);
+            // `z.tuple` takes at least one position; with none, `prefixItems: []` is any list.
+            return positions.length === 0
+                ? "z.array(z.unknown())"
+                : `z.tuple([${positions.join(", ")}], z.unknown())`;
+        }
         default:
             return refuse(program, type, "no rule for this kind", "Replace it with a model, scalar, enum or union, which are the kinds this emitter walks.");
     }